PT-2021-18608

Name of the Vulnerable Software and Affected Versions Web-School ERP version 5.0 Description The issue allows a remote attacker to create a voucher payment request through the "module/accounting/voucher/create" API endpoint. This is possible because the application fails to validate the CSRF toke...

CVE-2021-30114: Cross-Site Request Forgery (CSRF)

Web-School ERP V 5.0 contains a cross-site request forgery CSRF vulnerability that allows a remote attacker to create a voucher payment request through module/accounting/voucher/create. The application fails to validate the CSRF token for a POST request using admin privilege...