index.php?r=admini/admin/create in BageCMS V3.1.3 allows CSRF to add a background administrator account.
bagesoft bagecms 3.1.3