CVE-2024-5428: oretnom23 simple_online_bidding_system Cross-Site Request Forgery (CSRF)

Vulnerability summary

CVE-2024-5428 is a medium (CVSS 6.9) Cross-Site Request Forgery (CSRF) vulnerability in oretnom23 simple_online_bidding_system. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 25.4% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 28-05-2024
   PublishedVulnerability first disclosed.
2. 01-08-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability classified as problematic was found in SourceCodester Simple Online Bidding System 1.0. Affected by this vulnerability is the function save_product of the file /admin/index.php?page=manage_product of the component HTTP POST Request Handler. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-266383.

• CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.