CVE-2023-34927

This exploit demonstrates a CSRF vulnerability in Casdoor v2.95.0, allowing an attacker to change the victim's password by tricking them into submitting a crafted form. The PoC bypasses the old password authentication step via a hidden form submission.

This exploit demonstrates a CSRF vulnerability in Casdoor v2.55.0, allowing an attacker to change the victim's password by tricking them into submitting a crafted form. The PoC uses a hidden HTML form with JavaScript to automatically submit the request.

This exploit demonstrates a CSRF vulnerability in Casdoor's /api/set-password endpoint, allowing an attacker to change a victim's password without their old password. The PoC uses a crafted HTML form with hidden inputs to submit a password change request.