Executive brief
A security flaw exists in the Jason2605 AdminPanel, a tool used for website administration. An attacker can trick a logged-in administrator into visiting a malicious website that silently triggers the deletion of critical system files. This can lead to a complete bypass of security controls, forcing the application back into its initial setup mode and potentially allowing an attacker to take over the entire system.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in the delete.php endpoint of Jason2605 AdminPanel 4.0 and prior. The application fails to implement CSRF tokens or validate the Origin/Referer headers, and it incorrectly exposes sensitive deletion actions via GET requests. An attacker can exploit this by inducing an authenticated administrator to visit a malicious page that submits a forged request to delete critical files like 'verifyPanel.php'. Successful exploitation results in an authentication bypass as the application reverts to setup mode, potentially allowing for full system reinitialization. Mitigation requires implementing unique session-based CSRF tokens and restricting sensitive actions to POST requests.
Affected products
- Jason2605 AdminPanel 4.0 and prior
Timeline
- 2026-05-27: disclosed: Vulnerability details and PoC published by Mehdi Ben Hamou
- 2026-05-27: advisory: CVE-2026-30498 published to the NVD dataset