HexBrain

Mars · Report #2190062

No CSRF protection when adding an item to cart

Validstatus
lowseverity
29upvotes
30 Jan 2024disclosed

Summary

The given report highlights a security vulnerability in a web application. Specifically, a state-changing POST request to "██████" lacks proper authentication, making it susceptible to Cross-Site Request Forgery (CSRF) attacks. This means that an attacker could manipulate users into unknowingly and involuntarily triggering sensitive actions on the website. The absence of proper authentication opens up the possibility of unauthorized and malicious exploitation of the web application.

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original