CVE-2023-52073 is a high severity (8.8 CVSS) cross-site request forgery in FlyCms v1.0, in the /system/site/config_footer_updagte component, which updates the site footer configuration. We found no patched release, so add anti-CSRF protection, restrict admin access and check the upstream project.
What's affected
The NVD record lists FlyCms 1.0 from the flycms_project vendor entry. The researcher's report says the same: version 1.0, target repository sunkaifei/FlyCms. The report does not describe a fix or a patched version.
We cannot name a fixed release. Review the upstream repository for later commits or releases that touch the /system/site/config_footer_updagte handler before concluding you are protected.
How to check if you're exposed
Confirm whether FlyCms is deployed and which version it is. Look at your hosting inventory, the application directory and any release or version files.
Then check whether state changing admin requests carry an unpredictable token. A quick review in your browser's network tab of an admin form submission will show whether a per-session token is sent and validated. Do this only on sites you own.
What to do now
- Find all FlyCms 1.0 installs.
- Check the upstream FlyCms repository for a patch or newer release.
- Add a per-session anti-CSRF token to every state changing admin form and validate it server side.
- Check the Origin or Referer header on sensitive requests, and set session cookies with SameSite Lax or Strict.
- Ask administrators to log out when not working, and not to browse other sites in the same session. Require re-authentication for site wide settings changes.
Why it matters
The record maps this to CWE-352, cross-site request forgery. The endpoint accepts a request that changes site configuration without confirming it came from the legitimate admin page. If a logged in administrator visits a hostile page, their browser can submit that request with their session attached.
The vector needs user interaction, which explains the 8.8 score instead of 9.8. The researcher's page indicates the request succeeded against the endpoint but does not list every affected setting. Sibling CVEs (CVE-2023-52072, CVE-2023-52073 and CVE-2023-52074) cover three different FlyCms endpoints with the same class of flaw, so fixing one handler is not enough. The KEV flag is false.
For a wider view, the free in-browser dependency scan and the Gold directory help you see which packaged components in your own code carry known CVEs, and reachability analysis helps you decide which ones matter first.
Quick check
Why does CSRF need a logged in administrator?
The forged request rides on the administrator's browser session. If nobody with admin rights is signed in and visits the hostile page, the request has no authority.
Sources
Last reviewed: 19 October 2026.
