CMS Made Simple (aka CMSMS) 2.2.7 has CSRF in admin/moduleinterface.php.
cmsmadesimple cms made simple