## Clinic's patient management system has CSRF vulnerability
## supplier
https://www.sourcecodester.com/php-clinics-patient-management-system-source-code
## Vulnerability file
/pms/users.php
## describe
Unrestricted CSRF attacks exist in inventory management systems. Administrator user packages can be created directly without authorization to induce administrators to click, causing background information to be leaked.
## code analysis
There is a CSRF vulnerability in /auctioneer/users.php, which allows an attacker to gain server permissions.
CSRF POC
```
```
When the administrator clicks, an administrative account can be created.
