Cross-Site Request Forgery (CSRF) in hdinnovations/unit3d-community-edition


Reported on

Sep 24th 2021


CSRF in flushing peer

Proof of Concept

1. Login stafff/admin account
2. Access this link
3. See that the peers has been flushed.


This vulnerability is capable of flushing peers


We have contacted a member of the hdinnovations/unit3d-community-edition team and are waiting to hear back 2 years ago
HDVinnie validated this vulnerability 2 years ago
M0rphling has been awarded the disclosure bounty
The fix bounty is now up for grabs
HDVinnie marked this as fixed with commit 220db8 2 years ago
HDVinnie has been awarded the fix bounty
This vulnerability will not receive a CVE
web.php#L751 has been validated
to join this conversation