CVE-2025-3964: Books-Management-System CSRF Vulnerability

CVE-2025-3964 Overview

CVE-2025-3964 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] affecting withstars Books-Management-System 1.0. The flaw resides in an unknown function of the /api/article/del endpoint within the Article Handler component. An attacker who can lure an authenticated user to a crafted page can trigger unwanted article deletion requests. The exploit has been publicly disclosed and can be launched remotely over the network. The affected product is no longer supported by the maintainer, so no vendor patch is expected.

Critical Impact
Remote attackers can delete articles by tricking authenticated users into visiting attacker-controlled pages, with no patch available from the maintainer.

Affected Products

withstars Books-Management-System 1.0
CPE: cpe:2.3:a:withstars:books-management-system:1.0:*:*:*:*:*:*:*
Product is end-of-life and unsupported by the maintainer

Discovery Timeline

2025-04-27 - CVE-2025-3964 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3964

Vulnerability Analysis

The vulnerability is a Cross-Site Request Forgery flaw in the Article Handler component of Books-Management-System 1.0. The /api/article/del endpoint accepts state-changing delete requests without validating that the request originated from the legitimate application context. Because the endpoint lacks anti-CSRF tokens, SameSite cookie protections, or origin verification, an authenticated session cookie is sufficient to authorize the deletion. An attacker exploits this by hosting a malicious page that causes the victim's browser to issue a forged request to the vulnerable endpoint. User interaction is required, as the victim must be authenticated and must visit the attacker-controlled resource.

Root Cause

The root cause is missing CSRF protection [CWE-352] on the /api/article/del handler. The application relies solely on session cookies for authorization and does not verify request origin, Referer, or a synchronizer token. Any authenticated browser context can therefore be coerced into submitting delete operations without the user's intent.

Attack Vector

The attack is delivered over the network and requires user interaction. An attacker crafts an HTML page containing an auto-submitting form or image tag targeting /api/article/del with the identifier of the article to remove. When an authenticated administrator or user loads the page, the browser attaches the session cookie and the server processes the deletion. Technical exploitation details are documented in the GitHub CSRF Analysis and VulDB #306300 references.

Detection Methods for CVE-2025-3964

Indicators of Compromise

Unexpected POST or GET requests to /api/article/del with Referer or Origin headers pointing to external domains.
Article deletion events in application logs that do not correspond to legitimate administrative activity.
Spikes in 4xx/3xx responses from /api/article/del originating from a single user session across short time windows.

Detection Strategies

Inspect web server access logs for requests to /api/article/del where the Referer header is absent or points to an untrusted origin.
Correlate authenticated session activity with browsing behavior to identify requests generated outside the application's own pages.
Deploy WAF rules that flag state-changing requests to the Article Handler lacking a valid CSRF token or same-origin Referer.

Monitoring Recommendations

Enable verbose audit logging on all article deletion operations, including source IP, user agent, and Referer.
Alert on bulk article deletions performed within short intervals by a single account.
Forward web and application logs to a centralized analytics platform for cross-source correlation and retrospective hunting.

How to Mitigate CVE-2025-3964

Immediate Actions Required

Retire or replace withstars Books-Management-System 1.0, as the product is no longer maintained and no official patch will be issued.
Restrict access to the application to trusted internal networks or place it behind an authenticating reverse proxy.
Advise users to log out of the application when not in use to shrink the CSRF exploitation window.

Patch Information

No vendor patch is available. The vulnerability affects a product that is no longer supported by the maintainer. Organizations that continue to operate Books-Management-System 1.0 should plan migration to an actively maintained alternative. Refer to the VulDB entry for ongoing tracking.

Workarounds

Configure session cookies with the SameSite=Strict or SameSite=Lax attribute at the reverse proxy or application server to block cross-site cookie transmission.
Deploy a Web Application Firewall rule that rejects requests to /api/article/del when the Origin or Referer header does not match the application's own domain.
Require re-authentication or a confirmation step before destructive operations such as article deletion.

bash

# Example nginx configuration to block cross-origin requests to the vulnerable endpoint
location /api/article/del {
    if ($http_origin !~* ^https?://your-trusted-domain\.example$) {
        return 403;
    }
    proxy_pass http://books_management_backend;
    proxy_cookie_path / "/; SameSite=Strict; HttpOnly";
}