CVE-2023-33409 PoC — miniCal 跨站请求伪造漏洞

介绍

# CVE-2023-33409

Minical 1.0.0 is vulnerable to Cross-Site Request Forgery.

Vendor:       <https://github.com/minical/minical>

Demo Application: <https://demo.minical.io/>

***

## PoC

The application does not have any CSRF protection, hence a specially crafted HTTP request can be used to, 

- Add New User 
- Delete Existing User
- Edit the existing User’s Email Address and other sensitive information.

The payloads for different attacks can be generated using the Generate CSRF POC tool in BurpSuite.

Example:

Add New User:

![image](https://github.com/Thirukrishnan/CVE-2023-33409./assets/63901950/91c6a17a-b826-4f8b-877a-1094cb25f6a6)

文件快照

备注