CVE-2024-0880 is a medium severity (CVSS 4.3) cross-site request forgery in the password reset component of Qidianbang qdbcrm 1.1.0, at /user/edit?id=2. The vendor did not respond to disclosure and no fixed version exists in the record. Add anti-CSRF tokens or retire the application.
What's affected
Qidianbang qdbcrm 1.1.0. The affected path is /user/edit?id=2 in the Password Reset component. The record says the attack may be launched remotely and an exploit has been disclosed to the public.
The vendor was contacted early about the disclosure and did not respond, so no patched version is known.
The record classifies the weakness as CWE-352 (cross-site request forgery). NVD scores it 4.3 (Medium) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N.
The description calls the issue problematic, VulDB's term, while NVD scores it 4.3 (Medium). The two are consistent about a limited impact, since a victim must be tricked into a request.
How to check if you're exposed
There is no package manager command that answers this one, because the record points to a standalone application or a product that publishes no version history. Start with an inventory question: do you run Qidianbang qdbcrm anywhere, including test servers, lab machines and forgotten demo installs?
If you build software from source, search your repositories and artifact stores for the project name. The free in-browser dependency scan can flag known issues in the dependencies it finds, which helps when the component is vendored or pulled in transitively.
What to do now
- Find any qdbcrm 1.1.0 installs and decide whether they must stay online.
- Add CSRF protection to state changing requests, such as per session tokens and SameSite cookies.
- Require the current password before a password change takes effect.
- Move the application behind a VPN and plan a migration to a maintained product.
Why it matters
Cross-site request forgery (CWE-352) abuses a browser's habit of sending cookies automatically. A page controlled by an attacker can submit a request to the target while the victim is logged in. A password reset form without a token or current password check is the textbook target.
The score is moderate because the victim must visit a hostile page while signed in, but the result is account takeover.
The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing in the record says it is exploited in the wild. That can change, so keep it on your watch list.
Quick check
What stops CSRF?
Unpredictable per request tokens, SameSite cookie settings and requiring re-authentication for sensitive actions.
Sources
The links below are the references listed in the CVE record. The record and its description were the basis for this post, and the vendor advisory remains the authority for fixed versions.
Last reviewed: 19 October 2026.
