We've joined Protect AIJoin us over there for bounties up to $50,000+ for vulnerabilities in AI/ML repos

Cross-Site Request Forgery (CSRF) in hdinnovations/unit3d-community-edition

Valid

Reported on

Sep 24th 2021

Description

CSRF in deleting comments

Proof of Concept

1. Logging in using admin/staff account
2. Go to torrent https://unit3d.site/torrents/19#comments
3. Access the link https://unit3d.site/comments/delete/5
4 .See that the comment is deleted

Impact

This vulnerability is capable of deleting comments

Occurrences

We have contacted a member of the hdinnovations/unit3d-community-edition team and are waiting to hear back 2 years ago
HDVinnie validated this vulnerability 2 years ago
M0rphling has been awarded the disclosure bounty
The fix bounty is now up for grabs
HDVinnie marked this as fixed with commit cc1e68 2 years ago
HDVinnie has been awarded the fix bounty
This vulnerability will not receive a CVE
web.php#L191 has been validated
to join this conversation