CVE-2024-7460: Warehouse Inventory System CSRF Vulnerability

CVE-2024-7460 Overview

CVE-2024-7460 is a cross-site request forgery (CSRF) vulnerability affecting OSWAPP Warehouse Inventory System versions 1.0 and 2.0. The flaw resides in the /change_password.php endpoint, which lacks anti-CSRF protections. An attacker can craft a malicious web page that, when visited by an authenticated user, triggers an unauthorized password change request. The attack requires no privileges and can be launched remotely over the network. Public exploit details have been disclosed, increasing the risk of opportunistic abuse. The vulnerability is tracked as VulDB entry VDB-273553 and is categorized under CWE-352.

Critical Impact
Attackers can hijack an authenticated session to change a victim's password, leading to full account takeover of the affected Warehouse Inventory System instance.

Affected Products

Siamonhasan Warehouse Inventory System 1.0
Siamonhasan Warehouse Inventory System 2.0
Vulnerable component: /change_password.php

Discovery Timeline

2024-08-04 - CVE-2024-7460 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7460

Vulnerability Analysis

The vulnerability is a cross-site request forgery flaw in the password change workflow of the OSWAPP Warehouse Inventory System. The /change_password.php script accepts state-changing POST requests without validating an anti-CSRF token, origin header, or referer. When an authenticated administrator or user visits an attacker-controlled page, the browser automatically submits session cookies along with the forged request. The server processes the password update as if it were issued by the legitimate user. This results in unauthorized credential modification and persistent account takeover. The EPSS probability is approximately 0.35%, but public proof-of-concept availability lowers the practical barrier to exploitation.

Root Cause

The root cause is missing CSRF protection on a state-changing endpoint, as classified by CWE-352. The application relies solely on session cookies for authentication on the password change action. It does not verify that the request originated from a trusted page within the application. No synchronizer token, double-submit cookie, or SameSite cookie enforcement is implemented for this function.

Attack Vector

The attack vector is network-based and requires victim interaction with attacker-controlled content while authenticated. An attacker hosts a page containing an auto-submitting HTML form targeting /change_password.php with the attacker's chosen new password value. When the authenticated victim loads the page, the browser issues the request with valid session credentials. The server accepts and processes the password change. The attacker can then log in using the new password and assume the victim's identity within the inventory system. See the GitHub Gist Exploit Code and the VulDB advisory entry for additional technical context.

Detection Methods for CVE-2024-7460

Indicators of Compromise

Unexpected password change events recorded for users in the Warehouse Inventory System audit log.
HTTP POST requests to /change_password.php with Referer or Origin headers pointing to external or untrusted domains.
Successful logins from new IP addresses immediately following a password change event.
User reports of being locked out of their Warehouse Inventory System accounts without initiating a reset.

Detection Strategies

Inspect web server access logs for POST requests to /change_password.php originating from cross-origin referers.
Correlate password change events with the source IP and User-Agent of the preceding session activity to identify anomalies.
Monitor authentication systems for clusters of failed logins followed by successful logins after a password change.

Monitoring Recommendations

Enable verbose application-level logging for all account management endpoints, including timestamps and request headers.
Forward web server and application logs to a centralized SIEM for correlation and alerting on suspicious password change patterns.
Alert on any password change request lacking a valid same-origin Referer header.

How to Mitigate CVE-2024-7460

Immediate Actions Required

Restrict network access to the Warehouse Inventory System to trusted users and networks until a fix is deployed.
Force a password reset for all users and invalidate active sessions to revoke any compromised credentials.
Deploy a web application firewall (WAF) rule that blocks requests to /change_password.php without a same-origin Referer header.

Patch Information

No vendor patch is currently listed in the NVD or VulDB references for CVE-2024-7460. Administrators should monitor the VulDB entry for CVE-2024-7460 and the upstream project for any future security updates. Until a vendor fix is available, apply the workarounds below.

Workarounds

Add a synchronizer anti-CSRF token to the password change form and validate it server-side on every POST to /change_password.php.
Set session cookies with the SameSite=Strict and Secure attributes to prevent cross-site cookie attachment.
Validate the Origin and Referer headers on all state-changing requests and reject mismatched values.
Require the user to re-enter their current password as part of any password change operation.

bash

# Example Apache configuration to block cross-origin POSTs to change_password.php
<Location "/change_password.php">
    SetEnvIfNoCase Referer "^https?://your-warehouse-domain\.example/" same_origin
    <RequireAll>
        Require method GET
        Require env same_origin
    </RequireAll>
</Location>