A forged username cookie can impersonate comment authors
Summary
The application accepts a client-controlled, unsigned username cookie as the authenticated comment identity.
Affected version
Commit f72cf46f601efb2a0618c3814cc2f61380b38930.
Root cause and location
App/Home/Model/UserModel.class.php:82-84 reads cookie('username') as the current user. App/Home/Model/CommentModel.class.php:13-21 writes the same value to data['user']; Home/CommentController.class.php:8-16 checks only an AJAX header. ThinkPHP/Common/functions.php:1390-1415 stores scalar cookie values without a signature.
Reproduction
Choose an existing test username, then submit a comment with a forged cookie:
curl -sS -H 'X-Requested-With: XMLHttpRequest' \
-H 'Cookie: username=audituser' \
--data 'cid=1&manner=normal&content=COOKIE-IMPERSONATION-PROBE' \
http://TARGET/index.php/Home/Comment/addComment
The response is a new comment ID. The resulting row records audituser as its author even though no login took place:
audituser COOKIE-IMPERSONATION-PROBE
Capture the curl command and the resulting comment display or database row in a screenshot.
Impact
Attackers can publish misleading comments under another known user's identity and damage trust in account attribution.
Remediation
Use a server-side session containing an immutable user ID, validate it against the account record for every action, and never use a mutable username cookie as an identity assertion.
A forged username cookie can impersonate comment authors
Summary
The application accepts a client-controlled, unsigned username cookie as the authenticated comment identity.
Affected version
Commit
f72cf46f601efb2a0618c3814cc2f61380b38930.Root cause and location
App/Home/Model/UserModel.class.php:82-84readscookie('username')as the current user.App/Home/Model/CommentModel.class.php:13-21writes the same value todata['user'];Home/CommentController.class.php:8-16checks only an AJAX header.ThinkPHP/Common/functions.php:1390-1415stores scalar cookie values without a signature.Reproduction
Choose an existing test username, then submit a comment with a forged cookie:
The response is a new comment ID. The resulting row records
audituseras its author even though no login took place:Capture the curl command and the resulting comment display or database row in a screenshot.
Impact
Attackers can publish misleading comments under another known user's identity and damage trust in account attribution.
Remediation
Use a server-side session containing an immutable user ID, validate it against the account record for every action, and never use a mutable username cookie as an identity assertion.