关键信息 产品信息 Vendor Homepage: https://www.bdtask.com Software Link: https://codecanyon.net/item/wholesale-inventory-control-and-inventory-management-system/20291791 Demo URL: https://wholesaledemo.bdtask-demo.com/Admin_dashboard/login Affected Version: Latest version as of 2025-10-16 漏洞详情 Type: Cross-Site Request Forgery (CSRF) Affected URL: /dashboard/home/update_profile Vulnerable Component: The user profile update functionality. 漏洞类型 Cross-Site Request Forgery CWE ID: CWE-352 Severity Level: HIGH CVSS Score: 8.8 (High) 根源分析 The application's form for user profile updates lacks a per-session token, allowing an attacker to automatically submit the form and make unauthorized changes. 代码示例