Cross-site Request Forgery (CSRF)

area17/twill is vulnerable to cross-site request forgery. The vulnerability exists due to the use of unsecure GET request which allows an attacker to use the script src="" to log out any user who went to the attacker website...

Cross-Site Request Forgery (CSRF) in area17/twill

Description Attacker is able to logout a user if a logged in user visits attacker website. Impact This vulnerability is capable of forging user to unintentional logout. Test Tested on Edge, firefox, chrome and safari. Fix You should use POST instead of GET. To expand: One way GET could be abused...

Cross-site Scripting (XSS) - Reflected in area17/twill

Description The Application is vulnerable to reflected cross-site scripting attack. URL: /contact/offices/ Parameter: offset Proof of Concept Open the following URL in the browser for POC...