Cross-Site Request Forgery (CSRF) in kestasjk/webdiplomacy

Valid

Reported on

Jul 23rd 2021

✍️ Description

CSRF bug when contacting team

🕵️‍♂️ Proof of Concept

no csrf token contact .
Bellow request is vulnerable to csrf attack

POST /contactUsDirect.php HTTP/1.1
Host: webdiplomacy.net
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:88.0) Gecko/20100101 Firefox/88.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 139
Origin: https://webdiplomacy.net
Connection: close
Referer: https://webdiplomacy.net/contactUsDirect.php
Cookie: ....
Upgrade-Insecure-Requests: 1

issueType=otherIssue&games=0&gamesIssue=orders&otherIssue=rules&emergencyIssue=medical&additionalInfo=hhjhj%0D%0Asdfsfs&submit=Submit+Query

💥 Impact

csrf bug

Occurrences

contactUsDirect.php L79

We have contacted a member of the kestasjk/webdiplomacy team and are waiting to hear back 2 years ago

Kestas "Chris" Kuliukas validated this vulnerability 2 years ago

ranjit-git has been awarded the disclosure bounty

The fix bounty is now up for grabs

Kestas "Chris" Kuliukas marked this as fixed with commit 1be618 2 years ago

Kestas "Chris" Kuliukas has been awarded the fix bounty

This vulnerability will not receive a CVE

Kestas "Chris" Kuliukas Kestas

commented 2 years ago

Maintainer

Can you imagine someone submitting a contact us form on behalf of someone else? We're making this ransomware/nation-state-sponsored cybercrime world we live in just a bit safer, one board-game-website-form at a time :)