Challenge 15/36: CSRF on Admin Order Update - Cross-Site Attacks

Challenge 15/36 · Cross-Site Attacks CSRF on admin order update 🟡 Medium · Request Forgery · 45–60 min The admin order update endpoint authenticates via cookie and validates nothing else, allowing any same-session page to flip an order's status on the admin's behalf. Spin up the lab npx create-oss-store my-ctf-lab See it on the roadmap: https://koadt.github.io/oss-oopssec-store/roadmap#challenge-15 Walkthrough: https://koadt.github.io/oss-oopssec-store/posts/csrf-admin-order-update — spoilers, read it once you are stuck Star OopsSec Store on GitHub: https://github.com/kOaDT/oss-oopssec-store