CVE-2024-7367: Simple Realtime Quiz System CSRF Flaw

CVE-2024-7367 Overview

CVE-2024-7367 is a cross-site request forgery (CSRF) vulnerability in SourceCodester Simple Realtime Quiz System 1.0. The flaw resides in the /ajax.php?action=save_user endpoint, which lacks anti-CSRF protections. Attackers can craft a malicious web page that, when visited by an authenticated administrator, forces the browser to submit forged requests to the application. The exploit has been publicly disclosed and is tracked under VulDB identifier VDB-273351. The vulnerability is classified under CWE-352: Cross-Site Request Forgery.

Critical Impact
An attacker can remotely trigger unauthorized user account modifications by tricking an authenticated administrator into visiting a crafted page, leading to integrity loss in the quiz application.

Affected Products

SourceCodester Simple Realtime Quiz System 1.0
Vendor: oretnom23
CPE: cpe:2.3:a:oretnom23:simple_realtime_quiz_system:1.0

Discovery Timeline

2024-08-01 - CVE-2024-7367 published to NVD
2024-08-09 - Last updated in NVD database

Technical Details for CVE-2024-7367

Vulnerability Analysis

The Simple Realtime Quiz System exposes the save_user action through /ajax.php without verifying the origin or authenticity of incoming requests. The endpoint relies solely on the session cookie of an authenticated user to authorize account creation and modification operations. Because browsers automatically attach cookies to cross-origin requests, an attacker-controlled page can submit a forged POST request that the application processes as legitimate. The impact is limited to integrity, as no confidentiality or availability metrics are affected.

Root Cause

The root cause is the absence of a server-side anti-CSRF token validation mechanism on state-changing endpoints. The application does not implement synchronizer tokens, SameSite cookie attributes, or Origin/Referer header validation. Any authenticated session is sufficient to authorize sensitive operations.

Attack Vector

Exploitation requires no privileges or user interaction beyond visiting an attacker-controlled web page while authenticated to the quiz system. The attacker hosts an HTML form or JavaScript snippet that automatically submits a request to /ajax.php?action=save_user with attacker-chosen parameters such as username, password, and role. When the victim's browser issues the request, the application creates or modifies user records under the victim's authority. A public proof-of-concept is available at the GitHub PoC Script.

No verified code examples are available for this vulnerability. Refer to the VulDB entry #273351 for additional technical context.

Detection Methods for CVE-2024-7367

Indicators of Compromise

Unexpected user accounts created or modified in the quiz system's user table without administrator initiation.
HTTP POST requests to /ajax.php?action=save_user with Referer or Origin headers pointing to external, untrusted domains.
Web server access logs showing save_user invocations correlated with administrator sessions browsing unrelated websites.

Detection Strategies

Inspect web access logs for requests to /ajax.php?action=save_user where the Referer header does not match the application's own hostname.
Audit the application's user table on a recurring basis and alert on unexpected privilege changes or new administrative accounts.
Deploy a web application firewall (WAF) rule that blocks state-changing requests lacking a valid same-origin Referer or anti-CSRF token.

Monitoring Recommendations

Forward web server and application logs to a centralized analytics platform and correlate authentication events with save_user calls.
Monitor for spikes in 4xx or anomalous 2xx responses on the ajax.php endpoint to identify probing activity.
Track administrator browsing behavior through endpoint telemetry to identify visits to suspicious URLs immediately preceding user modification events.

How to Mitigate CVE-2024-7367

Immediate Actions Required

Restrict access to the quiz application to trusted networks until a patch is applied.
Instruct administrators to log out of the application before browsing untrusted sites.
Implement WAF rules that reject POST requests to /ajax.php without a same-origin Referer header.

Patch Information

At the time of publication, no official vendor patch is available from SourceCodester or the oretnom23 project for Simple Realtime Quiz System 1.0. Organizations using this software should consider applying source-level fixes that add anti-CSRF tokens to all state-changing endpoints and validate the Origin and Referer headers on the server side. Track updates through the VulDB advisory.

Workarounds

Set session cookies with the SameSite=Strict attribute to prevent cross-site cookie attachment.
Add a synchronizer token pattern to all forms invoking /ajax.php actions and validate the token on every request.
Restrict administrative access to the application via IP allowlisting or VPN to reduce exposure to drive-by CSRF attacks.

bash

# Example nginx configuration to enforce same-origin Referer on state-changing requests
location /ajax.php {
    if ($request_method = POST) {
        set $allowed 0;
        if ($http_referer ~* "^https?://quiz\.example\.com/") {
            set $allowed 1;
        }
        if ($allowed = 0) {
            return 403;
        }
    }
}