PT-2021-23754 · Unknown · Projectsworlds Online Book Store Php

Khanhchauminh · Published 2021-12-22 · Updated 2021-12-28 · CVE-2021-43156

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions ProjectWorlds Online Book Store PHP version 1.0

Description A CSRF issue in the admin delete.php file allows a remote attacker to delete any book.

Recommendations For ProjectWorlds Online Book Store PHP version 1.0, consider implementing proper CSRF protection mechanisms, such as tokens, to prevent unauthorized actions. As a temporary workaround, restrict access to the admin delete.php file to minimize the risk of exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2021-43156

Affected Products

Projectsworlds Online Book Store Php

References · 4

• 🔥 https://github.com/projectworldsofficial/online-book-store-project-in-php/issues/19 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-43156 · Security Note
• https://osv.dev/vulnerability/CVE-2021-43156 · Vendor Advisory
• https://t.me/cibsecurity/34514 · Telegram Post