Financial-record deletion via unvalidated cross-site request

CSRF in idcCMS 1.35 allows remote attackers to delete financial records by inducing an authenticated administrator to submit a request. The moneyRecord_deal.php handler accepts a delRecord request with attacker-controlled form fields without effective cross-site request validation. Exploitation requires an authenticated administrator to load or submit an attacker-crafted form, and the demonstrated effect is deletion of income and expense records.