| शीर्षक | SourceCodester Note Taking App 1.0 Cross Site Request Forgery |
|---|
| विवरण | A Cross-Site Request Forgery (CSRF) vulnerability was discovered in SourceCodester Note Taking App 1.0. The vulnerability exists in the note deletion functionality located in notes/delete.php. The application processes deletion requests via HTTP GET method using the id parameter without implementing any CSRF token validation or request origin
verification. An unauthenticated remote attacker can craft a malicious HTML page containing a hidden image tag or script that silently sends a deletion request to the vulnerable endpoint. When an authenticated victim visits the attacker-controlled page while logged into the application, the browser automatically includes the session cookie with the forged request, causing the victim's notes to be permanently deleted without their knowledge or consent. The attack requires no privileges and only needs the victim to visit a malicious webpage, making it easily exploitable through phishing or social engineering campaigns. |
|---|
| स्रोत | ⚠️ https://gist.github.com/Mohdanass/b7c5984922238397d10644f5f33ec592 |
|---|
| उपयोगकर्ता | Anas22335 (UID 96357) |
|---|
| सबमिशन | 11/03/2026 07:10 PM (7 महीनों पहले) |
|---|
| संयम | 27/03/2026 09:53 AM (16 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 353858 [SourceCodester Note Taking App तक 1.0 क्रॉस साइट रिक्वेस्ट फॉर्जरी] |
|---|
| अंक | 20 |
|---|