CVE-2024-45987

Projectworld Online Voting System Version 1.0 is vulnerable to Cross Site Request Forgery (CSRF) via voter.php. This vulnerability allows an attacker to craft a malicious link that, when clicked by an authenticated user, automatically submits a vote for a specified party without the user's consent or knowledge. The attack leverages the user's active session to perform the unauthorized action, compromising the integrity of the voting process.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/soursec/CVEs/tree/main/CVE-2024-45987	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:online_voting_system_project:online_voting_system:1.0:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-09-26 18:15

Updated : 2025-03-25 17:16

NVD link : CVE-2024-45987

Mitre link : CVE-2024-45987

CVE.ORG link : CVE-2024-45987

JSON object : View

Products Affected

online_voting_system_project

online_voting_system

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2024-45987", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2024-09-26T18:15:08.583", "references": [{"url": "https://github.com/soursec/CVEs/tree/main/CVE-2024-45987", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-352"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "Projectworld Online Voting System Version 1.0 is vulnerable to Cross Site Request Forgery (CSRF) via voter.php. This vulnerability allows an attacker to craft a malicious link that, when clicked by an authenticated user, automatically submits a vote for a specified party without the user's consent or knowledge. The attack leverages the user's active session to perform the unauthorized action, compromising the integrity of the voting process."}, {"lang": "es", "value": "Projectworld Online Voting System Version 1.0 es vulnerable a Cross Site Request Forgery (CSRF) a trav\u00e9s de voter.php. Esta vulnerabilidad permite a un atacante crear un v\u00ednculo malicioso que, cuando un usuario autenticado hace clic en \u00e9l, env\u00eda autom\u00e1ticamente un voto para un partido espec\u00edfico sin el consentimiento o conocimiento del usuario. El ataque aprovecha la sesi\u00f3n activa del usuario para realizar la acci\u00f3n no autorizada, lo que compromete la integridad del proceso de votaci\u00f3n."}], "lastModified": "2025-03-25T17:16:10.220", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:online_voting_system_project:online_voting_system:1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ECC3B251-845F-4FE1-8A9E-FFF2DA5F88B9"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}