Code Astro Internet Banking System Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability exists in Code Astro Internet Banking System version 2.0.0. This vulnerability allows remote attackers to execute arbitrary JavaScript on the admin account page. The issue arises from inadequate validation of user requests, enabling attackers to manipulate admin users into executing harmful scripts. Exploitation could lead to unauthorized changes in account settings or the theft of sensitive user information.

Impact

Exploitation of this vulnerability could result in unauthorized actions being performed on behalf of an admin user, such as altering account details or compromising sensitive information.

Reproduction

To reproduce this vulnerability, log into the admin portal of Code Astro Internet Banking System 2.0.0. Navigate to the Accounts section and intercept the request using Burp Suite. After capturing the request, generate a CSRF proof of concept by modifying the request to include updates for the name and email fields. Once the request is modified, test it in the browser. The name and email fields will be changed successfully, demonstrating the vulnerability.