Executive brief
SourceCodester's Dynamic Input Field Generator is a web application for collecting user input via HTML forms. The application lacks cross-site request forgery (CSRF) protection, allowing an attacker to trick users into unwittingly submitting malicious data to the application's database. An unauthenticated attacker can forge requests to insert arbitrary data, compromising data integrity and enabling unauthorized actions on behalf of affected users.
Technical details
The vulnerability is a cross-site request forgery (CWE-352) in the submit.php endpoint. The root cause is the absence of CSRF token generation, embedding, and validation: the form in index.php submits via POST with no anti-CSRF token, and submit.php processes all POST requests without verifying the request's origin or validating a token. An unauthenticated remote attacker can craft a malicious web page that, when visited by a user with an active session or connection to the target application, silently submits a forged POST request to submit.php and inserts arbitrary data into the database. No user interaction is required beyond loading the attacker's page. Mitigation requires implementing per-session CSRF tokens, embedding them in forms, and validating them server-side before processing requests.
Affected products
- SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0
Timeline
- 2026-07-06: disclosed: Vulnerability discovered and reported on GitHub
- 2026-08-21: advisory: CVE-2026-77391 published to NVD