CVE-2013-20005: Qool CMS 2.0 RC2 Cross-Site Request Forgery via adduser

Security readout for executives and security teams

CVE-2013-20005 affects Qool CMS 2.0 RC2. A malicious site could cause a logged-in administrator’s browser to create a new high-privilege user without the administrator intending it. This is mainly a risk for organizations still running this old CMS, especially if administrator sessions are active and the admin interface is reachable. Exposure is likely limited to environments still running Qool CMS 2.0/2.0 RC2 with accessible administrative functionality. Risk increases if administrators browse while authenticated and the site lacks CSRF protections. No evidence in the provided sources confirms broad deployment or internet-scale exposure. Treat this as a targeted-risk legacy CMS issue, not a broad emergency based on current evidence. Prioritize discovery and containment if Qool CMS is present. If internet-facing or used for business-critical content, move remediation higher because compromise could create administrator-level access. Mitigation focus: Identify any Qool CMS 2.0 or 2.0 RC2 instances.; Check Qool or maintainer guidance for fixed versions or official remediation.; Restrict administrative interfaces to trusted networks or VPN access..

Prepared

Apr 30, 2026, 01:34 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.