Cross-Site Request Forgery (CSRF) in ampache/ampache
Aug 31st 2021
csrf bug to disable user
🕵️♂️ Proof of Concept
I see during disable a user there is no csrf token is checking .
1. First login into admin account .
2. Now copy url
http://localhost/ampache-develop/public/admin/users.php?action=disable&user_id=3 and paste in browser tab and hit enter .
Now user will be disabled.
disable user using csrf bug