# Exploit Title: Casdoor v2.284.0 (2026-02-03) & v2.285.0 (2026-02-03) - Cross-Site Request Forgery (CSRF) # Application: Casdoor # Version: v2.284.0 (2026-02-03) & 2.285.0 (2026-02-03) # Date: 04/02/2026 # Exploit Author: Van Lam Nguyen # Facebook: vanlam1412 # Vendor Homepage: https://casdoor.org/ # Software Link v2.284.0: https://github.com/casdoor/casdoor/archive/refs/tags/v2.284.0.zip # Software Link v2.285.0: https://github.com/casdoor/casdoor/archive/refs/tags/v2.285.0.zip # Tested on: Windows # CVE: CVE-2023-34927 ( latest yet to be assigned) # POC: https://github.com/vanlam2001/csrf_casdoor Overview ================================================== Casdoor v2.284.0 & v2.285.0 and below was discovered to contain a Cross-Site Request Forgery (CSRF) in the endpoint /api/set-password. This vulnerability allows attackers to arbitrarily change the victim user's password via supplying a crafted URL. Proof of Concept ================================================== Made an unauthorized request to /api/set-password that bypassed the old password entry authentication step If a user is logged into the Casdoor Webapp at time of execution, a new user will be created in the app with the following credentials userOwner: built-in userName: admin newPassword: hacked