Description
An issue was discovered in REDCap 14.9.6. It has an action=myprojects&logout=1 CSRF issue in the alert-title while performing an upload of a CSV file containing a list of alert configuration. An attacker can send the victim a CSV file containing an HTML injection payload in the alert-title. Once the victim uploads the file, he automatically lands on a page to view the uploaded data. If the victim click on the alert-title value, it can trigger a logout request and terminates their session, or redirect to a phishing website. This vulnerability stems from the absence of CSRF protections on the logout functionality.
INFO
Published Date :
2025-01-10T00:00:00.000Z
Last Modified :
2025-01-13T20:35:35.849Z
Source :
mitre
AFFECTED PRODUCTS
The following products are affected by CVE-2025-23113 vulnerability.
| Vendors | Products |
|---|---|
| Vanderbilt |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2025-23113.
