CVE-2020-23960: 
PHP vulnerability analysis and mitigation

Multiple cross-site request forgery (CSRF) vulnerabilities were discovered in the Admin Console of Fork CMS versions before 5.8.3. These vulnerabilities allowed remote attackers to perform various unauthorized administrative actions including approving user comments, restoring deleted users, installing modules, resetting analytics, pinging mailmotor API, uploading to media library, and exporting locale (NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability is classified as CWE-352: Cross-Site Request Forgery (CSRF). The issue stemmed from insufficient CSRF token validation in various administrative actions, particularly those not using forms with built-in CSRF protection (NVD).

If exploited, this vulnerability could allow attackers to perform multiple unauthorized administrative actions including mass approval of user comments, restoration of deleted users, installation and execution of modules, analytics reset, API interactions, media library uploads, and locale exports (NVD).

The vulnerability requires user interaction and can be exploited remotely without authentication. The attack complexity is considered low, making it relatively straightforward to exploit (NVD).

The vulnerability was fixed in Fork CMS version 5.8.3. The fix included implementing CSRF token checks for all relevant administrative actions and ajax calls. Users should upgrade to version 5.8.3 or later to protect against these vulnerabilities (Fork CMS, GitHub PR).