# CVE-2025-67173: Cross-Site Request Forgery (CSRF) in RiteCMS version v3.1.0

RiteCMS is an ultrafast, lightweight, and easy-to-use CMS (Content Management System) based on PHP and SQLite.

A Cross-Site Request Forgery (CSRF) in the page creation/editing function of RiteCMS v3.1.0 allows attackers to arbitrarily create pages via a crafted POST request.
A CSRF vulnerability (CVE-2025-67173) can be leveraged to achieve RCE (CVE-2025-67172), forming an attack chain. 
Other CSRF vector can be used to achieve LFI (CVE-2025-67174) - lack of CSRF protection mechanisms.

Discovered by Michal Biesiada, Dec 2025.

**Proof of Concept**

Screenshots

<img width="1233" height="582" alt="poc-ritecms-csrf1a" src="https://github.com/user-attachments/assets/c5b419fb-a6a7-4676-9a7c-335e50161d33" />

<img width="1240" height="396" alt="poc-ritecms-csrf-rce1" src="https://github.com/user-attachments/assets/c1aab476-8ef1-4f52-a73d-f9d2441ef9d7" />

<img width="814" height="493" alt="poc-ritecms-csrf-rce2" src="https://github.com/user-attachments/assets/d444052a-24eb-448b-bca7-48d2853fe21a" />

<img width="788" height="245" alt="poc-ritecms-csrf-rce3" src="https://github.com/user-attachments/assets/013573c1-f0d5-458c-8361-fd60642af82c" />

<img width="597" height="165" alt="poc-ritecms-csrf-rce4" src="https://github.com/user-attachments/assets/0aa0b285-2e92-4edc-b924-d76b128cfa05" />

Attack Vectors:
- Remote. Authenticated user (admin or user/editor) visits an attacker-controlled webpage or clicks a crafted link. 
The attacker page auto-submits a POST to `http://<host>/admin.php?mode=edit&id=<id>` (the page-create/update endpoint) with parameters required by the CMS.
Because the application does not validate a per-request CSRF token, the action is executed with the victim's session.
An attacker-controlled page can create a persistent site page which can contain malicious payloads that, when rendered or processed by the server, lead to Remote Code Execution (RCE).
Thus the exploit is a chained attack: CSRF (initial vector) - persistent content injection - RCE. Other CSRF vector can be used to achieve LFI.

Affected Component:
- The application does not validate a per-request CSRF token, lack of CSRF protection mechanisms.

Example:
- Add New Page / Page editing functionality (`admin.php?mode=edit&id=`).
- Component: page creation/update handler accepting POST requests without CSRF token validation; content persisted as page body.

Impact:
- CSRF forming an attack chain.

Example:
- Persistent content injection / chained RCE. Persistence / Webshell installation. Different results for different vectors (ie. LFI possible).

CWE-ID:
- CWE-352: Cross-Site Request Forgery (CSRF)

References:
- https://github.com/handylulu/RiteCMS/
- https://github.com/mbiesiad/vulnerability-research/tree/main/CVE-2025-67172
- https://www.cve.org/CVERecord?id=CVE-2025-67173
- https://nvd.nist.gov/vuln/detail/CVE-2025-67173

## Disclaimer
For educational and defensive purposes only.