CSRF on Site Configuration leading to Total Site Defacement #157
Description
Description:
The com.site.blog.my.core.controller.admin.ConfigurationController#website interface is vulnerable to CSRF attacks. It allows an attacker to modify global website settings through a logged-in administrator.
Impact:
This is a high-impact vulnerability as it allows for total site defacement. An attacker can change the website's name, logo, footer information, and other core settings, effectively taking control of the site's visual identity and administrative information.
Cause:
Critical configuration updates are performed via standard POST requests that do not require a CSRF token or custom headers.
com.site.blog.my.core.controller.admin.ConfigurationController#website
Arbitrary modification of website configuration
Before the attack
After the attack
