CTF-hacker pwn delete.html cross-site request forgery

Vulnerability

A cross-site request forgery (CSRF) vulnerability exists in the delete.html file of CTF-hacker pwn. The issue affects an unknown version and allows an attacker to perform unauthorized actions on the administrator account. The vulnerability has been assigned the identifier VDB-215109 [1].

Exploitation

To exploit this vulnerability, an attacker must trick an authenticated administrator into visiting a crafted page or clicking a malicious link while logged into the application. No special network position or authentication is required aside from the victim's session. The attacker can then submit forged requests to the delete.html endpoint, performing actions on behalf of the administrator [1].

Impact

Successful exploitation enables the attacker to perform administrative actions, such as deleting content, without the administrator's consent. This leads to a loss of integrity and potentially availability, depending on what the delete.html function controls [1].

Mitigation

As of the publication date (2022-12-08), no fix or updated version has been released. The vendor has not provided a patch or workaround. Administrators should implement CSRF tokens and validate request origins to mitigate the risk [1].