Description

Cross-Site request forgery (CSRF) vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows Cross Site Request Forgery. This issue affects Talassoft Industrial Management Software: from V.4 before V.16.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-01T15:17:13.200Z",
  "pubdate": "2026-09-01T15:17:13.200Z",
  "executiveSummary": "A Cross-Site Request Forgery (CSRF) vulnerability exists in the TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software.\nThis vulnerability allows an unauthenticated remote attacker to force an authenticated user's browser to execute unwanted actions within the application without the user's consent.\nThe issue affects versions of Talassoft Industrial Management Software starting from V.4 and prior to V.16.\nSuccessful exploitation can result in unauthorized state-changing operations, such as modifying system configurations, changing user permissions, or executing administrative actions on behalf of the victim.\nThe risk is significant as it leverages the trust the application has in an authenticated user's session. The attacker must induce a victim who holds an active session with the Talassoft application to interact with a malicious crafted request, typically via social engineering or embedded content on a compromised or malicious third-party website.",
  "technicalDetails": "The vulnerability originates from a lack of adequate Cross-Site Request Forgery (CSRF) protection mechanisms within the Talassoft Industrial Management Software architecture.\nIn a CSRF attack, the application fails to validate the origin of requests or ensure the presence of cryptographically secure, unpredictable tokens (e.g., anti-CSRF tokens) within state-changing HTTP requests (e.g., POST, PUT, DELETE).\nBecause the web application relies solely on session cookies for authentication, and these cookies are automatically included by the browser in requests to the application domain, the server cannot distinguish between a legitimate request intentionally initiated by the user and a forged request initiated by a malicious site.\nThe attack flow proceeds as follows: 1) The attacker crafts a malicious webpage or email containing a hidden HTTP request targeting a sensitive function within the Talassoft application. 2) The attacker lures a victim, who is currently authenticated to the Talassoft management console, into visiting the malicious content. 3) The victim's browser automatically appends the valid session cookies to the forged request and transmits it to the Talassoft server. 4) The server receives the request, identifies the valid session context, and executes the requested action with the victim's privileges.\nSince the application does not enforce specific validation of the request origin (e.g., through SameSite cookie attributes or custom HTTP headers) or require per-request synchronization tokens, it accepts the forged request as legitimate.\nThis flaw impacts all components of Talassoft Industrial Management Software utilizing session-based authentication between versions V.4 and V.16. The impact is dependent on the privileges held by the victim; if the victim is an administrator, the attacker could effectively gain full control over the industrial management application, modify system settings, or manipulate data managed by the software.\nThe vulnerability is accessible over the network, requiring the victim's browser to reach the target application endpoint, and does not require the attacker to bypass authentication credentials directly, as they are essentially 'hijacking' the victim's existing authenticated state."
}