CVE-2024-7661: Car Driving School System CSRF Vulnerability

CVE-2024-7661 Overview

CVE-2024-7661 is a Cross-Site Request Forgery (CSRF) vulnerability affecting SourceCodester Car Driving School Management System 1.0. The flaw resides in the save_users function within the admin/user/index.php file. An attacker can craft a malicious web page that triggers unauthorized state-changing requests when an authenticated administrator visits it. The issue is classified under CWE-352: Cross-Site Request Forgery and has been publicly disclosed. Exploitation occurs remotely over the network and requires no authentication on the attacker side, only that a logged-in administrator interacts with the attacker-controlled content.

Critical Impact
An attacker can force an authenticated administrator's browser to submit forged user-management requests, enabling unauthorized creation or modification of user accounts in the application.

Affected Products

SourceCodester Car Driving School Management System 1.0
Vendor: oretnom23
Vulnerable component: admin/user/index.php (save_users function)

Discovery Timeline

2024-08-12 - CVE-2024-7661 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-7661

Vulnerability Analysis

The vulnerability stems from the absence of anti-CSRF protections in the user management workflow of the Car Driving School Management System 1.0. The save_users handler in admin/user/index.php accepts state-changing POST requests without verifying a per-session token or validating the request origin. An attacker who knows the application URL and the expected parameter names can craft an HTML form or JavaScript payload that submits to the endpoint. When an authenticated administrator loads the attacker-controlled content, the browser automatically includes session cookies, and the server processes the forged request as legitimate. The disclosure references can be reviewed in the GitHub CSRF Vulnerability Report and VulDB Entry #274119.

Root Cause

The save_users function does not implement a synchronizer token pattern, double-submit cookie, or SameSite cookie enforcement. There is no validation of the HTTP Origin or Referer header, and the application relies solely on session cookies for authorization. This omission allows any cross-origin POST request to act on behalf of an authenticated user.

Attack Vector

The attack vector is network-based and requires no privileges on the attacker side. An attacker hosts a malicious page containing a hidden HTML form that targets the save_users endpoint with attacker-chosen parameters such as username, password, and role. The attacker then lures an authenticated administrator to the page through phishing or a watering-hole technique. The administrator's browser submits the form automatically, and the server creates or updates a user record. Because the request is indistinguishable from a legitimate administrator action, the application performs the operation without restriction.

Detection Methods for CVE-2024-7661

Indicators of Compromise

Unexpected new administrator or user accounts appearing in the users table without corresponding administrator activity logs.
HTTP POST requests to admin/user/index.php containing a Referer header from an unrelated external domain or no Referer at all.
Web server access logs showing user-creation requests originating from administrator sessions immediately after the administrator visited an unfamiliar external URL.

Detection Strategies

Inspect web server logs for POST requests to admin/user/index.php and correlate them with the administrator's normal browsing patterns to identify cross-origin submissions.
Deploy a web application firewall rule that flags requests to the save_users endpoint when the Origin or Referer header does not match the application's own hostname.
Audit the application's user table on a recurring schedule and compare it against an authoritative source of expected accounts.

Monitoring Recommendations

Enable verbose application logging for all administrative actions, including the source IP, session ID, and request headers.
Forward web server and application logs to a centralized log management or SIEM platform for retention and alerting.
Configure alerts on privilege changes, new account creation, and role escalations within the application.

How to Mitigate CVE-2024-7661

Immediate Actions Required

Restrict access to the admin/ directory by IP allow-list or VPN until a code-level fix is deployed.
Instruct administrators to log out of the application before browsing untrusted sites and to use a dedicated browser profile for administrative tasks.
Review the application's user table for unauthorized accounts and remove any that cannot be attributed to legitimate activity.

Patch Information

No vendor patch is referenced in the NVD entry for CVE-2024-7661 at the time of publication. Operators should monitor the SourceCodester project page and the VulDB advisory for updates, or apply a custom code-level fix that adds CSRF token validation to the save_users handler.

Workarounds

Add a server-side CSRF token to every form that submits to admin/user/index.php and validate the token on each request before invoking save_users.
Set session cookies with the SameSite=Strict attribute so that browsers do not include them in cross-site POST requests.
Validate the Origin and Referer headers in PHP before processing state-changing actions, rejecting any request that does not match the application's hostname.
Place the administration interface behind a reverse proxy that requires an additional authentication factor not tied to browser cookies.

bash

# Example Apache rewrite rule to reject POSTs to the admin user endpoint
# when the Referer header does not match the application's own hostname.
RewriteEngine On
RewriteCond %{REQUEST_METHOD} =POST
RewriteCond %{REQUEST_URI} ^/admin/user/index\.php$
RewriteCond %{HTTP_REFERER} !^https?://your-app\.example\.com/ [NC]
RewriteRule ^ - [F,L]