提交 #881030: SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP N/A Cross-Site Request Forgery

A vulnerability was found in Sourcecodester Dynamic Input Field Generator Using HTML, CSS, and PHP. This vulnerability affects the file public/submit.php. Processing of the argument person leads to cross site request forgery. The attack can be launched remotely. No authentication is required for exploitation.

The application accepts POST requests to public/submit.php and performs a database insert, via the saveUser function in includes/queries.php, for every request received, without generating, embedding, or validating any anti-CSRF token. As a result, a third-party website can host a form that automatically submits to this endpoint, causing a victim's browser to insert attacker-controlled data into the application's database without the victim's knowledge or consent.

Proof of Concept:
The following HTML page, if visited by a user with network access to the target application, silently submits a forged request. Hosted on an attacker-controlled page:

form id equals f, action equals http colon slash slash TARGET slash public slash submit.php, method equals POST, containing a hidden input named person open bracket close bracket with value forged-by-csrf, followed by a script that calls document.getElementById of f dot submit.

Upon page load, the victim's browser sends a POST request to public/submit.php, and the value forged-by-csrf is inserted into the person table with no further interaction and no validation that the request originated from the application's own form.

Impact:
An unauthenticated remote attacker can force any visitor's browser to insert arbitrary data into the application's database. Because the application currently has no authentication layer, the direct impact is data integrity loss and mass forged submissions, application-level data pollution. In any deployment that later adds authentication or ties submissions to a user session, this same flaw would allow forged actions to be performed as the victim.

Mitigation:
Generate a per-session CSRF token, embed it as a hidden field in the form in public/index.php, and validate it in public/submit.php with a constant-time comparison, such as hash_equals, before processing the person array from the POST request. Reject the request outright if the token is missing, malformed, or does not match.

• 来源: ⚠️ https://gist.github.com/rionyxraiza/428d4481fe471704829ca06de7be9d8c
• 用户: Aswin K S (UID 99569)
• 提交: 2026-07-06 09時18分 (2 月前)
• 管理: 2026-08-20 21時38分 (2 months later)
• 状态: 已接受
• VulDB条目: 393853 [SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 跨网站请求伪造]
• 积分: 20