Cross-Site Request Forgery (CSRF) in hdinnovations/unit3d-community-edition


Reported on

Sep 24th 2021


CSRF in flushing peer

Proof of Concept

1. Login stafff/admin account
2. Access this link
3. See that the peers has been flushed.


This vulnerability is capable of flushing peers


We have contacted a member of the hdinnovations/unit3d-community-edition team and are waiting to hear back a year ago
HDVinnie validated this vulnerability a year ago
M0rphling has been awarded the disclosure bounty
The fix bounty is now up for grabs
HDVinnie confirmed that a fix has been merged on 220db8 a year ago
HDVinnie has been awarded the fix bounty
web.php#L751 has been validated
to join this conversation