| शीर्षक | PHPGurukul User Registration & Login and User Management System With admin panel 3.3 Cross-Site Request Forgery |
|---|
| विवरण | Web applications that change state (update profiles, transfer funds, change passwords) must ensure the request really comes from the legitimate user and not from a third-party site. However, during the security review, it was found that the profile update endpoint (edit-profile.php) accepts POST requests which modify user data without verifying an anti-CSRF token, checking Origin/Referer, or enforcing SameSite cookie policies. Because the application relies solely on the presence of a valid session cookie, an attacker who can convince an authenticated user to visit a malicious page can cause the user’s browser to send an authenticated request that the server will honor. |
|---|
| स्रोत | ⚠️ https://github.com/r4vindra/User-Registration-Login-and-User-Management-System-With-admin-panel |
|---|
| उपयोगकर्ता | r4vindra (UID 91109) |
|---|
| सबमिशन | 04/10/2025 01:10 PM (12 महीनों पहले) |
|---|
| संयम | 08/10/2025 04:49 PM (4 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 166816 [PHPGurukul User Registration & Login 2.1 क्रॉस साइट रिक्वेस्ट फॉर्जरी] |
|---|
| अंक | 0 |
|---|