CSRF Vulnerability in Sistem Informasi Pengumuman Kelulusan Online Allows Unauthorized Admin Creation

Executive Summary

This vulnerability is a cross-site request forgery (CSRF) in Sistem Informasi Pengumuman Kelulusan Online 1.0 that allows attackers to add unauthorized admin users by exploiting the tambahuser.php endpoint. Attackers can create a malicious HTML form that submits admin credentials to create new administrative accounts without the victim's consent.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to gain unauthorized administrative access to the system by creating new admin accounts. This can lead to unauthorized control over the application, potentially compromising the integrity and security of the system.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring HTTP requests to the tambahuser.php endpoint for suspicious POST requests that attempt to add new admin users without proper authorization. You can use network traffic analysis tools like Wireshark or tcpdump to capture and inspect such requests. For example, using tcpdump: tcpdump -i <interface> -A -s 0 'tcp port 80 or tcp port 443' | grep 'tambahuser.php'. Additionally, reviewing web server logs for POST requests to tambahuser.php that include admin user creation parameters can help identify exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include implementing CSRF protection mechanisms such as requiring CSRF tokens on the tambahuser.php endpoint, validating the origin of requests, and enforcing proper authentication and authorization checks before allowing admin user creation. Additionally, restricting access to the tambahuser.php endpoint to trusted users only and monitoring for suspicious activity can help reduce risk.

Useful 0 Not Useful 0