CVE-2024-56924: codeastro internet_banking_system Cross-Site Request Forgery (CSRF)

Vulnerability summary

CVE-2024-56924 is a high (CVSS 7.3) Cross-Site Request Forgery (CSRF) vulnerability in codeastro internet_banking_system. EPSS estimates a 0.45% chance of exploitation in the next 30 days, higher than 38.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 22-01-2025
   PublishedVulnerability first disclosed.
2. 23-01-2025
   Last modifiedVulnerability information updated.

Description

A Cross Site Request Forgery (CSRF) vulnerability in Code Astro Internet banking system 2.0.0 allows remote attackers to execute arbitrary JavaScript on the admin page (pages_account), potentially leading to unauthorized actions such as changing account settings or stealing sensitive user information. This vulnerability occurs due to improper validation of user requests, which enables attackers to exploit the system by tricking the admin user into executing malicious scripts.

• CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.