Отправить #1041016: SourceCodester Smart Attendance System with QR Code Scanner 1.0 Cross Site Request Forgery

Cross-site request forgery in SourceCodester Smart Attendance System with QR Code Scanner 1.0 allows a third-party page to make a logged-in administrator silently delete any student record (cascading to the attendance history) via a plain GET request.

Student deletion is bound to GET with no CSRF token, no Origin/Referer check and no SameSite cookie flag: delete_student.php performs DELETE FROM students WHERE id = ? (lines 6, 16-17) whenever $_GET['id'] is set; manage_students.php itself links ?delete=<id> (line 120). No anti-CSRF mechanism exists anywhere in the application.

CWE-352. CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N = 4.3.

Verified on a local deployment (PHP 7.3.4 / MySQL 5.7.26, 2026-10-17):
- GET /delete_student.php?id=2 with only the admin session cookie (no token) -> 302 to index.php
- DB: students rows for the target 1 -> 0 (record and cascaded logs removed)

Impact: silent destruction of student records and their attendance history (ON DELETE CASCADE) by any page the admin visits; at scale the whole student directory can be wiped. The stored XSS (student name field) can trigger the deletion from within the application itself.

Remediation: destructive actions must require POST + per-session CSRF token (hash_equals), same-origin enforcement, and a confirmation dialog; change links to POST forms.

PoC:
<img src="http://<TARGET>/delete_student.php?id=2" width="0" height="0">
# fires when any logged-in admin visits the attacker's page

White-box audit by EVA Security Research (yuechuya), 2026-10-17. Full 12-section report, source SHA-256 manifest and three-pass review:
https://github.com/yuechuya/sourcecodester-vuln-reports/blob/main/reports/VULN-05-CSRF-Student-Deletion.md

• Источник: ⚠️ https://github.com/yuechuya/sourcecodester-vuln-reports/blob/main/reports/VULN-05-CSRF-Student-Deletion.md
• Пользователь: yuechuya (UID 101209)
• Представление: 18.10.2026 10:42 (22 дни назад)
• Модерация: 09.11.2026 17:57 (22 days later)
• Статус: принято
• Запись VulDB: 433181 [SourceCodester Smart Attendance System with QR Code Scanner 1.0 подделка межсайтовых запросов]
• Баллы: 20