CVE-2025-3959: Books-Management-System CSRF Vulnerability

CVE-2025-3959 Overview

CVE-2025-3959 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in withstars Books-Management-System version 1.0. The flaw resides in the /reader_delete.html endpoint, which fails to validate the origin or authenticity of state-changing requests. An attacker can craft a malicious page that, when visited by an authenticated administrator, triggers unauthorized reader account deletions. The exploit has been publicly disclosed, and the product is no longer supported by the maintainer, so no official patch is expected.

Critical Impact
Remote attackers can trick authenticated users into deleting reader records without their consent, resulting in integrity loss across the application data.

Affected Products

withstars Books-Management-System 1.0
Component: /reader_delete.html
Status: End-of-life, no vendor support

Discovery Timeline

2025-04-27 - CVE-2025-3959 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3959

Vulnerability Analysis

The vulnerability affects the reader deletion functionality exposed through /reader_delete.html in withstars Books-Management-System 1.0. The endpoint accepts state-changing requests without verifying an anti-CSRF token, referer header, or origin. Any authenticated administrator visiting an attacker-controlled page can unknowingly submit a forged request that deletes reader records. The attack requires user interaction, specifically that a privileged user with an active session loads the malicious content. Because the application is no longer maintained, defenders must rely on compensating controls rather than a vendor fix.

Root Cause

The root cause is missing CSRF protection on a state-changing HTTP endpoint. The /reader_delete.html handler does not implement synchronizer tokens, double-submit cookies, or SameSite cookie enforcement. Session authentication alone is insufficient to establish request intent, which is the core weakness described by [CWE-352].

Attack Vector

Exploitation is network-based and requires an authenticated victim to visit attacker-controlled content while holding a valid session. The attacker hosts an HTML page containing an auto-submitting form or image tag pointing at the vulnerable delete endpoint. When the victim's browser issues the request, it automatically attaches the session cookie, and the application processes the deletion as if it were legitimate. No credentials are exposed to the attacker, but data integrity is compromised.

No verified public exploit code is available beyond the disclosure. Technical details are documented in the GitHub CSRF Vulnerability Document and the VulDB Threat Intelligence Report.

Detection Methods for CVE-2025-3959

Indicators of Compromise

Unexpected DELETE or POST requests to /reader_delete.html originating from external referer domains
HTTP requests to the delete endpoint lacking a matching CSRF token parameter
Reader account records disappearing without corresponding administrator UI activity in application logs

Detection Strategies

Inspect web server access logs for requests to /reader_delete.html and correlate the Referer header against the expected application origin
Deploy a Web Application Firewall (WAF) rule that flags cross-origin POST requests to sensitive administrative paths
Alert on bursts of reader deletion events performed within short time windows outside normal administrator working hours

Monitoring Recommendations

Forward web server and application logs into a centralized analytics platform for correlation across sessions and source IPs
Track administrator session activity, including the pages visited immediately before a deletion request is issued
Establish a baseline for legitimate deletion volumes and alert on statistical deviations

How to Mitigate CVE-2025-3959

Immediate Actions Required

Restrict access to the Books-Management-System administrative interface to trusted internal networks or VPN users only
Instruct administrators to log out of the application when not actively using it to shrink the CSRF attack window
Deploy a reverse proxy or WAF that enforces Origin and Referer validation on requests to /reader_delete.html
Consider migrating off withstars Books-Management-System 1.0 since it is no longer supported by the maintainer

Patch Information

No official patch is available. The product is end-of-life and the vendor does not maintain security updates. Organizations must apply compensating controls or migrate to a supported alternative.

Workarounds

Configure session cookies with SameSite=Strict at the reverse proxy layer to block cross-site cookie transmission
Add a WAF rule that requires a valid Referer header matching the application's own hostname on all state-changing requests
Isolate the application behind an authentication proxy that injects an additional per-request token administrators must include

bash

# Example WAF-style Nginx configuration enforcing Referer validation
location = /reader_delete.html {
    if ($http_referer !~* "^https?://books\.internal\.example\.com/") {
        return 403;
    }
    proxy_pass http://books_backend;
}