Cross-Site Request Forgery (CSRF) in hdinnovations/unit3d-community-edition

Valid

Reported on

Sep 24th 2021

Description

CSRF in flushing peer

1. Login stafff/admin account
2. Access this link https://unit3d.site/dashboard/flush/peers
3. See that the peers has been flushed.

This vulnerability is capable of flushing peers

web.php L751

We have contacted a member of the hdinnovations/unit3d-community-edition team and are waiting to hear back 2 years ago

HDVinnie validated this vulnerability 2 years ago

M0rphling has been awarded the disclosure bounty

The fix bounty is now up for grabs

HDVinnie marked this as fixed with commit 220db8 2 years ago

HDVinnie has been awarded the fix bounty

This vulnerability will not receive a CVE

to join this conversation