# Affected software: Ilch cms # Type of vulnerability: csrf # URL: http://www.ilch.de/ # Discovered by: Provensec # Website: http://www.provensec.com # Description: Ilch cms profile field csrf # Proof of concept http://demo.opensourcecms.com/ilch/admin.php?profilefields (online demo) Above field was vulnerable to csrf vulnerability attacker was able to add value to the field due to lack of csrf token csrf poc: -- Best Regards, *Ankit Bharathan.* *Save Energy... Save Nature... Go Green...* P *Consider the environment. Please don't print this e-mail unless absolutely necessary.*