AdminPanel 4.0 CSRF File Deletion / Setup-Mode Reset — CVE-2026-30498

Metadata

Affected Target

Summary

AdminPanel 4.0’s delete.php endpoint performs a sensitive file-deletion action (deleting verifyPanel.php) via a simple GET request, with no CSRF token, no Origin/Referer validation, and no confirmation of user intent. An attacker can host a page that auto-submits a forged request to this endpoint; if an authenticated administrator visits the page, their browser automatically attaches session cookies, causing verifyPanel.php to be deleted. Because verifyPanel.php is used to gate whether the application has completed setup, its removal forces the application back into an unauthenticated “setup mode,” effectively bypassing authentication and allowing full system reinitialization by anyone who reaches the app afterward.

Vulnerability Details

Root Cause

Missing CSRF protections (no anti-CSRF token, no Origin/Referer checks) on a state-changing, sensitive GET endpoint (delete.php) that relies solely on ambient session cookies for authorization.

Attack Vector

1. Attacker hosts a malicious page (evil.html) containing an auto-submitting form targeting http://<target>/delete.php?file=verifyPanel.php.
2. Attacker lures an authenticated AdminPanel user/administrator into visiting the malicious page.
3. The victim’s browser automatically includes their AdminPanel session cookie with the forged request.
4. delete.php deletes verifyPanel.php without validating the request’s origin or intent, forcing the application into setup mode.

Impact

Deletion of a security-gating file leading to application-wide authentication bypass and the ability to fully reinitialize the system’s configuration (effective full compromise of the AdminPanel instance).

Environment / Lab Setup

Target:   AdminPanel 4.0 running via `php -S localhost:8080`
Attacker: Any web browser to host/serve attacker/evil.html

Proof of Concept

PoC Script

See attacker/evil.html and victim/ (index.php, delete.php, reset.php, panel/dashboard.php) in this folder.

1

php -S localhost:8080 -t victim/

evil.html auto-submits a hidden GET form to delete.php?file=verifyPanel.php on load; once a logged-in victim visits it, their session cookie authorizes the deletion, forcing the target application into setup mode.

Detection & Indicators of Compromise

Signs of compromise:

• Unexpected disappearance of verifyPanel.php and the application reverting to a setup/installation screen
• delete.php requests with cross-site Referer/Origin headers
• Administrator session activity immediately preceding an unplanned application reset

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/Mehdi-Ben-Hamou/CVE-2026-30498 on 2026-07-05.