CVE-2024-7459
📋 TL;DR
This CSRF vulnerability in OSWAPP Warehouse Inventory System allows attackers to trick authenticated users into performing unintended actions by visiting malicious web pages. It affects all users of OSWAPP Warehouse Inventory System versions 1.0 and 2.0 with the vulnerable /edit_account.php endpoint accessible.
💻 Affected Systems
- OSWAPP Warehouse Inventory System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could modify user accounts, change passwords, or alter system settings by tricking administrators into clicking malicious links while authenticated.
Likely Case
Attackers could modify regular user account details or perform limited administrative actions depending on the victim's privileges.
If Mitigated
With proper CSRF protections, the attack would fail as requests would require valid anti-CSRF tokens.
🎯 Exploit Status
Exploit requires victim to be authenticated and visit a malicious page. The attack is simple to execute with basic web development knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider implementing CSRF protection manually or migrating to a supported system.
🔧 Temporary Workarounds
Implement CSRF Tokens
allAdd anti-CSRF tokens to all form submissions and validate them server-side
Manual code modification required - add unique token generation and validation to /edit_account.php and related forms
SameSite Cookie Attribute
allSet SameSite=Strict or SameSite=Lax on session cookies to prevent cross-site requests
Set-Cookie: session_id=value; SameSite=Strict; Secure; HttpOnly
🧯 If You Can't Patch
- Implement WAF rules to detect and block CSRF attempts
- Restrict access to /edit_account.php to specific IP ranges or require re-authentication for sensitive actions
🔍 How to Verify
Check if Vulnerable:
Check if /edit_account.php accepts POST requests without CSRF token validation by testing with tools like Burp Suite or manually submitting forms without tokens.Check Version:
Check application version in admin panel or source code headers. No standard command available.Verify Fix Applied:
Test that all form submissions to /edit_account.php require and validate unique CSRF tokens that cannot be reused or predicted.📡 Detection & Monitoring
Log Indicators:
- Multiple failed form submissions from same IP
- Requests to /edit_account.php with missing or invalid tokens
- Unusual account modification patterns
Network Indicators:
- HTTP POST requests to /edit_account.php without Referer headers matching origin
- Requests with predictable or missing CSRF tokens
SIEM Query:
source="web_logs" AND uri="/edit_account.php" AND (NOT csrf_token=* OR csrf_token="") | stats count by src_ip