CVE-2026-3770 Details

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in SourceCodester Computer Laboratory Management System version 1.0. The issue arises because the application does not implement adequate CSRF protection on state-changing requests, particularly those handled by the 'save_users' function in 'classes/Users.php'. This vulnerability allows an attacker to craft a malicious webpage that, when visited by an authenticated administrator, can trigger unauthorized modifications to the administrator's account. Such exploitation could lead to a takeover of the administrative account and a complete compromise of the application.

It is recommended to implement anti-CSRF tokens for all state-changing requests, validate the origin and referer headers, enforce SameSite cookie attributes, and require server-side CSRF validation before processing POST requests.