SourceCodester Simple Cold Storage Management System Contact Us cross-site request forgery

Vulnerability

A cross-site request forgery (CSRF) vulnerability exists in SourceCodester Simple Cold Storage Management System version 1.0 in the Contact Us functionality, specifically in the file /csms/?page=contact_us. The manipulation of requests leads to CSRF, allowing an attacker to trigger unintended actions on behalf of an authenticated user. [1]

Exploitation

An attacker can craft a malicious web page or HTML email that, when visited by an authenticated user, sends a forged request to the vulnerable endpoint. The attack can be launched remotely without requiring any special network position or authentication for the attacker, but relies on the victim being logged into the application. [1]

Impact

Successful exploitation enables the attacker to perform actions within the context of the victim's session, such as modifying contact details or submitting forms, potentially leading to data manipulation or further unauthorized operations. The CIA impact is partial, primarily affecting integrity and availability of the contact functionality. [1]

Mitigation

As of the publication date (2022-10-18), no official patch or fixed version has been released by the vendor. Developers should implement CSRF tokens in all state-changing forms and ensure proper request validation. The affected system is end-of-life and users are advised to migrate to a supported solution. [1]