CICIT Portal LMS CSRF Vulnerability Analysis & PoC (CWE-352)

VULN-08 Summary of Key Vulnerability Information I. Vulnerability Overview Vulnerability Name: Cross-Site Request Forgery (CSRF) – Missing Anti-CSRF Token Affected System: Syllabus-Aligned Learning Management & Examination System (CICIT Portal) Severity Level: MEDIUM CVSS v3.1 Score: 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) CWE: CWE-352 (Cross-Site Request Forgery) Date Discovered: 2026-07-25 Core Issue: All state-changing operations within the CICIT Portal lack CSRF protection: no anti-CSRF token, no SameSite Cookie attribute, and no Referer/Origin validation. II. Scope of Impact Affected Files: All PHP files handling forms (Version 1.0) Affected Dangerous Operations (No CSRF Protection): - Delete Exam ( , GET) - Delete Subject ( , GET) - Create User ( , POST) - Create Exam ( , POST) - Update Exam ( , POST) - Approve/Reject Enrollment ( , GET) - Register Student ( , POST) - Upload File ( , POST) - Generate Attendance ( , POST) - Add Subject ( , POST) - Create Schedule ( , POST) - Update Profile ( , POST) - Clear Attendance ( , POST) - CSV Import ( , POST) - Batch Enrollment ( , POST) Worst Case Scenario: State-changing operations based on GET requests (deleting exams, approving/rejecting enrollments) can be triggered via malicious links. III. PoC Code PoC 1: Triggering Exam Deletion via Image Tag PoC 2: Auto-submitted CSRF POST Form PoC 3: Registering a Student into an Unauthorized Course PoC 4: Batch Approve/Reject Enrollments via CSRF PoC 5: Clearing Attendance Records via CSRF IV. Impact Data Destruction: Exams, subjects, and schedules can be silently deleted. Account Creation: A backdoor super_admin account can be created. Attendance Manipulation: Students can be arbitrarily enrolled/unenrolled. Exam Tampering: Exam content, duration, and status can be modified. Attendance Fraud: Attendance records can be created or cleared. Grade Manipulation: Grade records can be tampered with when combined with other variables. Batch Exploitation: GET-based operations can be triggered by simple tags. Potential Harm: CSRF can be embedded within Stored XSS (VULN-05) to enable self-propagating attacks. V. Remediation Plan 1. Implement an Anti-CSRF Token System: Create a shared helper in to generate and validate random tokens. 2. Add Token to All Forms: Include in all forms. 3. Validate Token in All State-Changing Endpoints: Call in POST handlers. 4. Convert GET-Based State Changes to POST: For example, change from GET to POST and validate the CSRF token. 5. Set the SameSite Cookie Attribute: Set in the function in . 6. Add Referer/Origin Validation (Defense in Depth): Validate that the request's or header originates from the application's own domain. VI. References CWE-352: https://cwe.mitre.org/data/definitions/352.html OWASP CSRF Prevention Cheat Sheet: https://cheatsheets.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html OWASP CSRF Community Attack Examples: https://owasp.org/www-community/attacks/csrf

Goal Reached Thanks to every supporter — we hit 100%!

CICIT Portal LMS CSRF Vulnerability Analysis & PoC (CWE-352)

More from this source