SOY CMS 3.0.2 and earlier is affected by Cross-site Request Forgery (CSRF) and Remote Code Execution (RCE). This allows remote attackers to force the administrator to edit files once the adminsitrator loads a specially crafted webpage.

Impact: CSRF to RCE via Unrestricted File Modification

• Attack vector is: Administrator must be logged in.
• Components are: Soy Inquiry
• Tested SOY CMS Version : 3.0.2 (latest)
• Affected SOY CMS Version : ~3.0.2

Found by @stypr from Vulnerability Research Team in Flatt Security Inc.

Reference:

https://youtu.be/ffvKH3gwyRE
Issue: #7
Fix PR: #15