| शीर्षक | Rizwan17 inventory-management-system bfe78a330d01bb26b9daec5dc9ecd5c77900e03f Cross-Site Request Forgery |
|---|
| विवरण | The affected component is `includes/process.php` and all client forms that POST to it (`js/main.js`, `js/manage.js`, `js/order.js`). State-changing operations (add/update/delete category/brand/product, place orders, register users) accept simple POST bodies with no CSRF token, no Origin/Referer validation, and no SameSite-strict session cookie policy:
```javascript
$.ajax({
url : DOMAIN+"/includes/process.php",
method : "POST",
data : $("#category_form").serialize(),
...
})
```
A malicious page can force a victim browser (especially when a session cookie exists) to mutate inventory data. Because handlers also lack authentication (CVE-04), CSRF is not even required for unauthenticated abuse; when auth is later added without tokens, CSRF remains exploitable. |
|---|
| स्रोत | ⚠️ https://github.com/Rizwan17/inventory-management-system/issues/17 |
|---|
| उपयोगकर्ता | rainless100792 (UID 84115) |
|---|
| सबमिशन | 03/08/2026 10:16 AM (1 महीना पहले) |
|---|
| संयम | 12/09/2026 08:47 PM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 403181 [Rizwan17 inventory-management-system तक 5e74a46b4b70623d0e4a0c9c4aee3bd1777185d2 includes/process.php क्रॉस साइट रिक्वेस्ट फॉर्जरी] |
|---|
| अंक | 20 |
|---|