Authenticated request forgery via missing CSRF middleware

Cross-site request forgery in MobSF Mobile Security Framework before 4.5.1 allows remote attackers to modify data via forged POST requests. In mobsf/MobSF/settings.py, django.middleware.csrf.CsrfViewMiddleware was left only in deprecated MIDDLEWARE_CLASSES and omitted from the active MIDDLEWARE tuple, so authenticated web endpoints processed state-changing POST requests without CSRF token validation. Exploitation requires a logged-in victim to visit an attacker-controlled page, and the attacker can delete scans, upload or download applications, change passwords, or manage users within that victim account's privileges.