Отправить #877726: SourceCodester Onlne Examination & Learning Management System using PHP and MySQL Latest release available as of July 2026 CSRF Allows Unauthorized Profile Modification

A Cross-Site Request Forgery (CSRF) vulnerability was identified in the account profile update functionality of the "Onlne Examination & Learning Management System using PHP and MySQL". The application does not adequately protect state-changing requests against CSRF attacks, allowing authenticated users to unknowingly perform unintended actions initiated by an attacker.
During security testing, a legitimate HTTP request used to update a user's profile information was intercepted using a web proxy. A CSRF Proof-of-Concept (PoC) was generated from the captured request and modified to contain attacker-controlled values for the username and email parameters. The PoC was then saved as an HTML file.
When the HTML file was opened by an authenticated Instructor user in a web browser while logged into the application, the browser automatically submitted the forged request using the victim's active authenticated session. The server accepted the request without requiring a valid anti-CSRF token or any additional verification of the request's origin. As a result, the Instructor's username and email address were successfully changed to the attacker-specified values without the victim's knowledge or consent.

This behaviour indicates that the application does not implement effective CSRF protection for sensitive account management operations. The vulnerable endpoint accepts authenticated requests solely based on the presence of the user's session, without verifying that the request originated from a legitimate page within the application.

An attacker can exploit this vulnerability by creating a malicious webpage containing a forged profile update request and persuading an authenticated user to visit it through phishing emails, instant messaging, social engineering, or malicious advertisements. Because the victim's browser automatically includes valid session cookies with the request, the application processes the request as if it were intentionally submitted by the authenticated user.

The vulnerability affects the integrity of user account information and demonstrates insufficient protection of privileged state-changing operations.

IMPACT :

Successful exploitation allows an attacker to perform unauthorized actions on behalf of an authenticated user without requiring knowledge of the victim's credentials.

• Unauthorized modification of user profile information.

• Modification of the victim's username.

• Unauthorized replacement of the registered email address.

• Loss of integrity of account information.

• Disruption of normal user account management.

• Interference with account recovery mechanisms if password reset functionality relies on the registered email address.

• Increased likelihood of social engineering attacks by replacing profile information with attacker-controlled values.

• Loss of trust in the application's access control and account management processes.

• The vulnerability can be exploited remotely by delivering a malicious webpage or HTML file to an authenticated victim.

• No direct interaction with the application is required beyond the victim visiting the attacker-controlled content while authenticated.

If higher-privileged users such as Instructors or Administrators are affected, the overall impact may increase because sensitive account information belonging to privileged users can be modified without authorization.

MITIGATION :

To prevent Cross-Site Request Forgery attacks, the application should implement multiple layers of protection for all state-changing requests.

1. Implement cryptographically secure anti-CSRF tokens for every form and state-changing request.

2. Validate the CSRF token on the server before processing any request that modifies application data.

3. Reject requests containing missing, invalid, expired, or reused CSRF tokens.

4. Configure authentication cookies with the SameSite=Lax or SameSite=Strict attribute to reduce the risk of cross-site request submission.

5. Validate the Origin and Referrer headers for sensitive operations and reject requests originating from untrusted domains.

6. Require password re-authentication before allowing modifications to sensitive account information such as username or email address.

7. Consider implementing multi-factor authentication or additional verification when changing security-sensitive account settings.

8. Record all profile modification events in audit logs, including the authenticated user, timestamp, source IP address, and modified fields.

9. Regularly perform security assessments to ensure CSRF protection is consistently enforced across all sensitive endpoints.

10. Follow secure development practices and industry guidance such as the OWASP Cross-Site Request Forgery Prevention Cheat Sheet to ensure comprehensive protection against CSRF attacks.

The implementation of proper server-side CSRF validation, secure cookie attributes, request origin verification, and additional confirmation mechanisms will significantly reduce the risk of unauthorized state-changing requests and protect authenticated users from CSRF attacks.

• Источник: ⚠️ https://www.sourcecodester.com/php/18739/syllabus-aligned-learning-management-examination-system.html
• Пользователь: airish (UID 99445)
• Представление: 02.07.2026 09:08 (2 месяцы назад)
• Модерация: 17.08.2026 20:48 (2 months later)
• Статус: принято
• Запись VulDB: 391392 [SourceCodester Onlne Examination & Learning Management System 1.0 подделка межсайтовых запросов]
• Баллы: 20