Fabian Ros/SourceCodester Simple E-Banking System 跨站请求伪造漏洞

A successful CSRF attack against Simple E-Banking System could allow an attacker to initiate unauthorized fund transfers, modify account details, or perform other sensitive actions on behalf of a legitimate user. The attack is initiated remotely, meaning an attacker doesn't need direct access to the server. The published exploit significantly increases the risk of exploitation, as attackers can readily leverage it to target vulnerable systems. The blast radius extends to any user of the affected Simple E-Banking System, particularly those who regularly access the system through web browsers.

Small to medium-sized businesses and organizations that rely on Simple E-Banking System for their financial transactions are at significant risk. Specifically, those using the vulnerable versions 1.0–1.0 without proper security controls, such as WAFs or input validation, are particularly susceptible to exploitation.

• generic web:

curl -I <banking_system_url> | grep -i 'csrf-token'

• generic web:

 grep -r 'csrf_token' /var/www/html/

1. 2025-11-13Disclosure

   disclosure

1. 已保留2025-11-13
2. 发布日期2025-11-13
3. EPSS 更新日期2026-03-23

The primary mitigation for CVE-2025-13119 is to upgrade to version 1.0.1 of Simple E-Banking System. If upgrading immediately is not feasible, implement temporary mitigations such as implementing strict input validation on all user-supplied data and employing a Web Application Firewall (WAF) with CSRF protection rules. Consider adding a SameSite cookie attribute to prevent cross-site requests. Regularly review and update security configurations to minimize the attack surface. After upgrading, confirm the vulnerability is resolved by attempting a CSRF attack via a testing tool.