An unauthenticated authentication bypass vulnerability exists in the bg5sbk MiniCMS article management interface, allowing unauthorized users to modify or publish site content.

The application fails to perform adequate authentication checks within the /mc-admin/post-edit.php file. An unauthenticated attacker can bypass security controls by crafting specific POST requests, allowing them to access administrative article editing and publishing functions without valid session credentials.

Successful exploitation permits attackers to deface corporate websites, inject malicious content, or manipulate sensitive information. This vulnerability poses a significant risk to brand reputation and site integrity, as unauthorized parties can gain control over public-facing content management functions. While the CVSS score of 7.3 reflects a high severity, the potential for unauthorized content injection could lead to regulatory compliance issues and loss of user trust.

Immediate Action: As no official patch is currently available from the vendor, administrators should immediately restrict access to the /mc-admin/ directory at the web server level, ensuring that only authorized IP addresses or VPN-connected clients can reach the administrative interface.

Proactive Monitoring: Monitor web server access logs for anomalous POST requests directed at /mc-admin/post-edit.php, specifically identifying requests that lack valid session cookies or originate from unrecognized or suspicious IP addresses.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block or challenge all requests to the /mc-admin/post-edit.php endpoint that do not contain valid administrative session tokens.

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the technical write-up provided by the researcher on GitHub.

Given the availability of a public proof-of-concept and the lack of a vendor-provided patch, this vulnerability presents a credible risk to any deployment of MiniCMS. Organizations must prioritize network-level restrictions to isolate the administrative interface from the public internet. Until an official update is released, treat this component as untrusted and maintain strict monitoring of all administrative activity.