abbisqq/cve-2025-28355It was identified that the https://github.com/Volmarg/personal-management-system application is vulnerable to CSRF attacks.
It was identified that the https://github.com/Volmarg/personal-management-system application is vulnerable to CSRF attacks, one of the many action an attacker can perform is trick a legitimate user to run a cross site request that will alter his/her password, allowing the attacker access to the application. The vulnerability requires browsers that have the “SameSite” cookie attribute defaults value to none such as Firefox.
Vektor String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS Score: 4.7
Proof of concept For the demonstration I will use the username tester and change that user password to “missingcsrf” Note that the attacker can change other values such as the nickname and the lock password. The application is generally vulnerable to CSRF, meaning a malicious user can trick users to upload files change password mess records etc.
This is a simple html page that will make the cross-site request when the user visit the malicious URL.
Running the above in a Firefox browser, the password changed successfully.
Finally, we log in with the modifies password and we can see we getting redirected to the dashboard page, which means the login was successful.
