Cross-Site Request Forgery (CSRF) in hdinnovations/unit3d-community-edition


Reported on

Sep 24th 2021


CSRF in deleting comments

Proof of Concept

1. Logging in using admin/staff account
2. Go to torrent
3. Access the link
4 .See that the comment is deleted


This vulnerability is capable of deleting comments


We have contacted a member of the hdinnovations/unit3d-community-edition team and are waiting to hear back a year ago
HDVinnie validated this vulnerability a year ago
M0rphling has been awarded the disclosure bounty
The fix bounty is now up for grabs
HDVinnie confirmed that a fix has been merged on cc1e68 a year ago
HDVinnie has been awarded the fix bounty
web.php#L191 has been validated
to join this conversation