Blog Article: https://medium.com/p/02d2dc83b2f6
Summary
Inadequate Cross-Site Request Forgery (CSRF) token validation has been identified.
Details
The current implementation fails to properly validate CSRF tokens when activating or deactivating controllers. This vulnerability allows an attacker to exploit CSRF attacks, potentially enabling them to change website features that should only be managed by administrators through malicious requests.
Proof of Concept
Video: https://github.com/user-attachments/assets/0b04e625-72be-411a-810e-ba4892f6a7a2
Impact
This CSRF vulnerability poses a significant risk by allowing unauthorized users to alter the functionality of the website. An attacker could enable or disable critical features, potentially disrupting services, compromising security, and undermining the integrity of the platform.
Hacking-Notes Reporter
Blog Article: https://medium.com/p/02d2dc83b2f6
Summary
Inadequate Cross-Site Request Forgery (CSRF) token validation has been identified.
Details
The current implementation fails to properly validate CSRF tokens when activating or deactivating controllers. This vulnerability allows an attacker to exploit CSRF attacks, potentially enabling them to change website features that should only be managed by administrators through malicious requests.
Proof of Concept
Video: https://github.com/user-attachments/assets/0b04e625-72be-411a-810e-ba4892f6a7a2
Impact
This CSRF vulnerability poses a significant risk by allowing unauthorized users to alter the functionality of the website. An attacker could enable or disable critical features, potentially disrupting services, compromising security, and undermining the integrity of the platform.