Description

Hi there, I would like to report a Cross Site Request Forgery in phoronix source code. Cross-site request forgery (also known as CSRF) is a web security vulnerability that allows an attacker to induce users to perform actions that they do not intend to perform. It allows an attacker to partly circumvent the same origin policy, which is designed to prevent different websites from interfering with each other.

Proof of Concept

1. Install a local instance of phoronix test suite
2. Create a schedule, note down the schedule id
3. Access this link /?schedules/<schedule-id>/deactivate and see that the schedule is deactivated
4. Access this link /?schedules/<schedule-id>/activate and see that the schedule is activated.
5. In real attack scenarios, the hacker would send the 2 above links to the victim and when they clicks it, their schedules are activated/deactivated without their consent.

Impact

This vulnerability is capable of CSRF.