CVE-2021-29349 PoC — Catalyst IT Mahara 跨站请求伪造漏洞

Source

https://github.com/Vulnmachines/CVE-2021-29349

Associated Vulnerability

Title:Catalyst IT Mahara 跨站请求伪造漏洞 (CVE-2021-29349)
Description:Mahara 20.10 is affected by Cross Site Request Forgery (CSRF) that allows a remote attacker to remove inbox-mail on the server. The application fails to validate the CSRF token for a POST request. An attacker can craft a module/multirecipientnotification/inbox.php pieform_delete_all_notifications request, which leads to removing all messages from a mailbox.

Description

CVE-2021-29349 CSRF to remove all messages in Mahara 20.10

Readme

# CVE-2021-29349
CVE-2021-29349 CSRF to remove all messages in Mahara 20.10

Payload and Credit https://github.com/0xBaz

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!