CVE-2021-30112

Name of the Vulnerable Software and Affected Versions Web-School ERP version 5.0

Description The issue allows a remote attacker to create a student leave application request through the "module/core/studentleaveapplication/create" API endpoint. This is due to the application's failure to validate the CSRF token for a POST request when using the Guardian privilege.

Recommendations For Web-School ERP version 5.0, ensure proper validation of the CSRF token for all POST requests, especially those using the Guardian privilege, to prevent unauthorized creation of student leave applications. As a temporary workaround, consider restricting access to the "module/core/studentleaveapplication/create" API endpoint until a proper fix is implemented.