Cross-Site Request Forgery (CSRF) in dolibarr/dolibarr

Valid

Reported on

Jul 18th 2021


✍️ Description

Attacker able to reopen any Poll in Tools section.

🕵️‍♂️ Proof of Concept

// PoC.html

https://demo.dolibarr.org/opensurvey/card.php?action=reopen&id=amyra52rg3g4ywzj

We have contacted a member of the dolibarr team and are waiting to hear back a year ago
amammad modified the report
a year ago
amammad modified the report
a year ago
amammad modified the report
a year ago
Laurent
a year ago

Maintainer


Is this still true with v14 ?

amammad
a year ago

Researcher


Hi dear Laurent Detailer, according to your security policies the vulnerabilities on versions equal and greater that 13 will be accepted, I do my security testes according to your policy, please consider this, tanks a lot my dear, your friend Amammd.

amammad
a year ago

Researcher


also this 2 days ago I don't have any access to your new version and already until now your repository don't release version 14? how I can test it my dear? Please help me to understand this problem of mine. tanks again dear Laurent

amammad
a year ago

Researcher


hey dollibar team if you want more help and exact report just tell me now.i'm ready to help you.

amammad
a year ago

Researcher


Hi dear Laurent Destailleur. If you want to fix these CSRF vulnerabilities in easy way, you can set all your cookies with Strict attribute. sorry for taking you valuable time.

amammad modified the report
a year ago
Laurent Destailleur marked this as fixed with commit 4253b5 a year ago
Laurent Destailleur has been awarded the fix bounty
This vulnerability will not receive a CVE
to join this conversation