PT-2023-25498 · Unknown · Projectworlds Online Examination System

Kryptohaker · Published 2023-07-07 · Updated 2023-07-13 · CVE-2023-36256

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions The Online Examination System Project version 1.0

Description The issue allows an attacker to perform Cross-Site Request Forgery (CSRF) attacks. An attacker can create a malicious link that, when clicked by an admin user, will delete a user account from the database without the admin's consent. The email of the user to be deleted is passed as a parameter in the URL, which can be manipulated by the attacker. This could result in a loss of data.

Recommendations For version 1.0, consider implementing proper CSRF protection mechanisms to prevent unauthorized actions. As a temporary workaround, restrict access to the user account deletion functionality to minimize the risk of exploitation. Avoid using the email parameter in the URL for deleting user accounts until the issue is resolved.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2023-36256

Affected Products

Projectworlds Online Examination System

References · 5

• 🔥 https://exploit-db.com/exploits/51511 · Exploit
• 🔥 https://hackersnotes.com/blog/pentest/online-examination-system-project-1-0-cross-site-request-forgery-csrf · Exploit
• https://osv.dev/vulnerability/CVE-2023-36256 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-36256 · Security Note
• https://t.me/cibsecurity/66225 · Telegram Post