Mars · Report #2190062
No CSRF protection when adding an item to cart
Validstatus
lowseverity
29upvotes
30 Jan 2024disclosed
Summary
The given report highlights a security vulnerability in a web application. Specifically, a state-changing POST request to "██████" lacks proper authentication, making it susceptible to Cross-Site Request Forgery (CSRF) attacks. This means that an attacker could manipulate users into unknowingly and involuntarily triggering sensitive actions on the website. The absence of proper authentication opens up the possibility of unauthorized and malicious exploitation of the web application.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.