| Título | SourceCodester Smart Attendance System with QR Code Scanner 1.0 Cross Site Request Forgery |
|---|
| Descrição | Cross-site request forgery in SourceCodester Smart Attendance System with QR Code Scanner 1.0 allows a third-party page to make a logged-in administrator silently delete any student record (cascading to the attendance history) via a plain GET request.
Student deletion is bound to GET with no CSRF token, no Origin/Referer check and no SameSite cookie flag: delete_student.php performs DELETE FROM students WHERE id = ? (lines 6, 16-17) whenever $_GET['id'] is set; manage_students.php itself links ?delete=<id> (line 120). No anti-CSRF mechanism exists anywhere in the application.
CWE-352. CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N = 4.3.
Verified on a local deployment (PHP 7.3.4 / MySQL 5.7.26, 2026-10-17):
- GET /delete_student.php?id=2 with only the admin session cookie (no token) -> 302 to index.php
- DB: students rows for the target 1 -> 0 (record and cascaded logs removed)
Impact: silent destruction of student records and their attendance history (ON DELETE CASCADE) by any page the admin visits; at scale the whole student directory can be wiped. The stored XSS (student name field) can trigger the deletion from within the application itself.
Remediation: destructive actions must require POST + per-session CSRF token (hash_equals), same-origin enforcement, and a confirmation dialog; change links to POST forms.
PoC:
<img src="http://<TARGET>/delete_student.php?id=2" width="0" height="0">
# fires when any logged-in admin visits the attacker's page
White-box audit by EVA Security Research (yuechuya), 2026-10-17. Full 12-section report, source SHA-256 manifest and three-pass review:
https://github.com/yuechuya/sourcecodester-vuln-reports/blob/main/reports/VULN-05-CSRF-Student-Deletion.md |
|---|
| Fonte | ⚠️ https://github.com/yuechuya/sourcecodester-vuln-reports/blob/main/reports/VULN-05-CSRF-Student-Deletion.md |
|---|
| Utilizador | yuechuya (UID 101209) |
|---|
| Submissão | 18/10/2026 10h42 (há 22 dias) |
|---|
| Moderação | 09/11/2026 17h57 (22 days later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 433181 [SourceCodester Smart Attendance System with QR Code Scanner 1.0 Falsificação de Pedido entre Sites] |
|---|
| Pontos | 20 |
|---|