| 标题 | atjiu https://github.com/atjiu/pybbs <=6.0.0 CSRF |
|---|
| 描述 | In the latest version (v6.0.0) of PyBBS, no any CSRF protection, the endpoint /admin/user/edit is used for admin user to modify user's information, such as password, email, bio, etc, all the parameters can be predicted, it allows attacker launch CSRF attacks, thus changing user's information. |
|---|
| 来源 | ⚠️ https://github.com/atjiu/pybbs/issues/211 |
|---|
| 用户 | ZAST.AI (UID 87884) |
|---|
| 提交 | 2025-07-25 09時57分 (1 年前) |
|---|
| 管理 | 2025-08-09 14時35分 (15 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 319343 [atjiu pybbs 直到 6.0.0 CookieUtil.java setCookie 跨网站请求伪造] |
|---|
| 积分 | 17 |
|---|