Cross-Site Request Forgery (CSRF) in kestasjk/webdiplomacy

Valid

Reported on

Jul 23rd 2021


✍️ Description

CSRF bug when contacting team

🕵️‍♂️ Proof of Concept

no csrf token contact .
Bellow request is vulnerable to csrf attack

POST /contactUsDirect.php HTTP/1.1
Host: webdiplomacy.net
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:88.0) Gecko/20100101 Firefox/88.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 139
Origin: https://webdiplomacy.net
Connection: close
Referer: https://webdiplomacy.net/contactUsDirect.php
Cookie: ....
Upgrade-Insecure-Requests: 1

issueType=otherIssue&games=0&gamesIssue=orders&otherIssue=rules&emergencyIssue=medical&additionalInfo=hhjhj%0D%0Asdfsfs&submit=Submit+Query

💥 Impact

csrf bug

We have contacted a member of the kestasjk/webdiplomacy team and are waiting to hear back 2 months ago
Kestas "Chris" Kuliukas validated this vulnerability 2 months ago
ranjit-git has been awarded the disclosure bounty
The fix bounty is now up for grabs
Kestas "Chris" Kuliukas confirmed that a fix has been merged on 1be618 2 months ago
Kestas "Chris" Kuliukas has been awarded the fix bounty
Kestas
2 months ago

Maintainer


Can you imagine someone submitting a contact us form on behalf of someone else? We're making this ransomware/nation-state-sponsored cybercrime world we live in just a bit safer, one board-game-website-form at a time :)

ranjit-git
2 months ago

Researcher