An issue exists in idreamsoft iCMS V7.0.10. admincp.php?app=user&do=save allows CSRF.
idreamsoft icms 7.0.10