UWA 2.3.11 allows index.php?g=admin&c=admin&a=add_admin_do CSRF.
asthis universal website asthis 2.3.11