CVE-2025-1891: Qzw1210 Shishuocms CSRF Vulnerability

CVE-2025-1891 Overview

CVE-2025-1891 is a Cross-Site Request Forgery (CSRF) vulnerability affecting shishuocms version 1.1, a content management system published by qzw1210. The flaw resides in an unspecified processing function and allows remote attackers to trigger unauthorized state-changing actions by tricking authenticated administrators into loading a crafted request. Public proof-of-concept material demonstrates the attack path for adding an administrator account without the target's consent. The exploit has been disclosed publicly, increasing the risk of opportunistic abuse against exposed deployments.

Critical Impact
Successful exploitation allows attackers to perform administrative actions, including creating new administrator accounts, by luring an authenticated admin to a malicious page.

Affected Products

qzw1210 shishuocms 1.1
CPE: cpe:2.3:a:qzw1210:shishuocms:1.1:*:*:*:*:*:*:*
Deployments exposing the administrative interface to untrusted browsing sessions

Discovery Timeline

2025-03-04 - CVE-2025-1891 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-1891

Vulnerability Analysis

The vulnerability is classified under CWE-352: Cross-Site Request Forgery. The application performs sensitive state-changing operations without validating that the request originated from a legitimate, intentional user interaction. Because shishuocms relies solely on the browser-managed session cookie for authorization, any HTTP request emitted from an authenticated administrator's browser is trusted by the server.

An attacker can host a malicious page or embed a hidden form on a compromised site. When an authenticated administrator visits that page, the browser automatically attaches the valid session cookie to the outbound request. The server processes the request as if the administrator issued it deliberately.

Public PoC material from the GitHub CVE PoC Repository demonstrates an attack that adds a new administrator account through a forged POST request. Additional metadata is tracked in VulDB ID #298409.

Root Cause

The root cause is the absence of anti-CSRF protections on administrative endpoints. The application does not require a synchronizer token, does not verify the Origin or Referer header, and does not set the session cookie with the SameSite attribute. This design allows cross-origin requests to reuse the authenticated session.

Attack Vector

The attack is network-based and requires user interaction from an authenticated administrator. The adversary crafts an HTML page containing an auto-submitting form or JavaScript fetch call targeting the vulnerable endpoint. When the administrator visits the page, the browser issues the request with valid credentials, and the server executes the administrative action. No prior authentication or privilege on the attacker side is required.

No verified exploitation code from an authoritative source is included in this article. Refer to the linked PoC and VulDB entries above for the full technical walkthrough.

Detection Methods for CVE-2025-1891

Indicators of Compromise

Creation of new administrator accounts in shishuocms without a corresponding change ticket or admin session activity
Web server access logs containing state-changing POST requests with Referer headers pointing to external or unexpected domains
Administrative session activity immediately following the administrator visiting an untrusted URL

Detection Strategies

Inspect web application logs for POST requests to administrator management endpoints that lack a same-origin Referer or Origin header
Correlate account creation events with the requesting user agent, source IP, and browser navigation history
Alert on any unexpected privilege escalation event in the shishuocms administrative user table

Monitoring Recommendations

Enable verbose logging on administrative endpoints and forward logs to a centralized SIEM for retention and correlation
Baseline normal administrator activity patterns and flag deviations, such as account creation outside business hours
Monitor outbound web traffic from administrator workstations for known malicious or newly registered domains

How to Mitigate CVE-2025-1891

Immediate Actions Required

Restrict access to the shishuocms administrative interface to trusted IP ranges or a VPN
Require administrators to use a dedicated browser or browser profile for administrative work, isolated from general browsing
Audit the administrator account list and remove any unauthorized entries created since deployment
Rotate credentials for all administrator accounts after the audit

Patch Information

At the time of publication, no vendor patch has been referenced in the NVD entry or in the associated VulDB CTI ID #298409 advisory. Users of shishuocms 1.1 should monitor the upstream project for an updated release and consider migrating to an actively maintained CMS if no fix is issued.

Workarounds

Place the application behind a reverse proxy that enforces Referer and Origin header validation on state-changing requests
Configure a Web Application Firewall rule to block POST requests to administrative paths when the Origin header is missing or does not match the application host
Set session cookies with SameSite=Strict at the reverse proxy layer to prevent cross-site cookie transmission
Require administrators to explicitly log out after each session to shorten the window of exploitability

bash

# Example nginx configuration enforcing same-origin on admin endpoints
location /admin/ {
    if ($request_method = POST) {
        set $csrf_check "";
        if ($http_origin !~* "^https://cms\.example\.com$") {
            set $csrf_check "${csrf_check}1";
        }
        if ($http_referer !~* "^https://cms\.example\.com/") {
            set $csrf_check "${csrf_check}1";
        }
        if ($csrf_check = "11") {
            return 403;
        }
    }
    proxy_pass http://shishuocms_backend;
    proxy_cookie_path / "/; SameSite=Strict; Secure; HttpOnly";
}