There is a CSRF vulnerability in admin/article.php

[PassingFoam]

the cms post the form without random token,so it will cause a cstf vulnerability.
we create a test.html

if the administrator has logined, and then he click the test.html

the article has been deleted