Cross-Site Request Forgery (CSRF) in bigprof-software/online-rental-property-manager
Jul 3rd 2021
app/admin/pageDeleteGroup.php?groupID=<ID> does not have a CSRF protection. This could be used by attackers to trick the admin to delete a group from their system.
🕵️♂️ Proof of Concept
<html> <body> <a href="http://<host>/online-rental-property-manager-6.8/app/admin/pageDeleteGroup.php?groupID=6">Click Here !</a> </body> </html>
When an admin clicks the link a member is deleted.
This vulnerability is capable of deleting groups from the platform.
Fix Introduce a CSRF token in the request.