CVE-2025-3959
📋 TL;DR
This CSRF vulnerability in withstars Books-Management-System 1.0 allows attackers to trick authenticated users into performing unauthorized actions via the /reader_delete.html endpoint. It affects all deployments of this unsupported software version. The vulnerability can be exploited remotely without authentication.
💻 Affected Systems
- withstars Books-Management-System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could delete reader records or perform other administrative actions by tricking authenticated users, potentially disrupting library operations or causing data loss.
Likely Case
Targeted attacks against library staff to delete specific reader accounts or manipulate reader data through forged requests.
If Mitigated
With proper CSRF protections, the vulnerability would be prevented as legitimate requests would require valid tokens.
🎯 Exploit Status
Exploit requires social engineering to trick authenticated users; technical barrier is low.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: None
Vendor Advisory: None
Restart Required: No
Instructions:
No official patch available as software is no longer maintained. Consider migrating to supported alternative.
🔧 Temporary Workarounds
Implement CSRF Tokens
allAdd CSRF protection tokens to all forms and validate them server-side
Manual code modification required
WAF Rule for CSRF Protection
allConfigure web application firewall to detect and block CSRF attempts
Depends on specific WAF platform
🧯 If You Can't Patch
- Isolate the application behind authentication and restrict access to trusted users only
- Implement SameSite cookie attributes and referrer validation
🔍 How to Verify
Check if Vulnerable:
Check if /reader_delete.html endpoint lacks CSRF token validation by inspecting form submissionsCheck Version:
Check application version in admin panel or configuration filesVerify Fix Applied:
Test that all forms require and validate CSRF tokens before processing requests📡 Detection & Monitoring
Log Indicators:
- Multiple DELETE requests to /reader_delete.html from same IP without corresponding form submissions
- Unusual deletion patterns in reader management logs
Network Indicators:
- HTTP POST/DELETE requests to /reader_delete.html without Referer header or CSRF tokens
SIEM Query:
source="web_logs" AND (uri="/reader_delete.html" AND method="POST") AND NOT csrf_token=*