| Título | atjiu https://github.com/atjiu/pybbs <=6.0.0 CSRF |
|---|
| Descrição | In the latest version (v6.0.0) of PyBBS, no any CSRF protection, the endpoint /admin/user/edit is used for admin user to modify user's information, such as password, email, bio, etc, all the parameters can be predicted, it allows attacker launch CSRF attacks, thus changing user's information. |
|---|
| Fonte | ⚠️ https://github.com/atjiu/pybbs/issues/211 |
|---|
| Utilizador | ZAST.AI (UID 87884) |
|---|
| Submissão | 25/07/2025 09h57 (há 1 Ano) |
|---|
| Moderação | 09/08/2025 14h35 (15 days later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 319343 [atjiu pybbs até 6.0.0 CookieUtil.java setCookie Falsificação de Pedido entre Sites] |
|---|
| Pontos | 17 |
|---|