search

siamon123 / warehouse-inventory-system

Open source inventory management system with php and mysql
http://www.oswapp.com
MIT License
379 stars 233 forks source link

CSRF Change Admin Password #55

Open boku7 opened 3 years ago

boku7 commented 3 years ago

Cross-Site Request Forgery (CSRF) on edit_user.php page allows changing the admin password from a 3rd party site. For fix see: https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html