CSRF Vulnerability in PHPJabbers Cinema Booking System

CVE-2024-57429 is a CSRF vulnerability identified in the PHPJabbers Cinema Booking System v2.0. The flaw exists within the 'pjActionUpdate' function, which fails to properly validate the authenticity of requests. An attacker can craft a malicious web page containing a hidden form that triggers an automated POST request to the application's administrative update endpoint. By tricking an authenticated administrator into visiting the attacker-controlled page, the victim's browser initiates the request under their active session. This allows the attacker to modify user attributes, including account roles and passwords, resulting in unauthorized privilege escalation or full account takeover of administrative profiles. Because the application lacks sufficient anti-CSRF protections on this sensitive function, it remains highly vulnerable to social engineering-based exploitation.

Impact

Successful exploitation allows remote, unauthenticated attackers to escalate privileges to administrative level. This leads to complete administrative account takeover, including the ability to change passwords, modify user permissions, and potentially disrupt or compromise the booking platform. The vulnerability poses a medium risk due to the requirement for user interaction.

Recommendation

Prioritize the implementation of anti-CSRF tokens for all state-changing operations within the PHPJabbers Cinema Booking System application. Until a vendor-supplied patch is available, instruct administrative users to avoid clicking unknown links while logged into the application dashboard. Implement strict Referer and Origin header validation on the 'pjActionUpdate' endpoint to verify that requests originate from legitimate platform pages.