CVE-2024-25344: Insufficient Information (NVD-CWE-noinfo)
value: Cross Site Scripting vulnerability in ITFlow.org before commit v.432488eca3998c5be6b6b9e8f8ba01f54bc12378 allows a remtoe attacker to execute arbitrary code and obtain sensitive information via the settings.php, settings+company.php, settings_defaults.php,settings_integrations.php, settings_invoice.php, settings_localization.php, settings_mail.php components.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-02-26T16:27Z
Repository: https://github.com/itflow-org/itflow
Language: PHP
Files changed: post/setting.php, settings_online_payment.php
Commit date: 2023-11-25 16:36:05 +0000
Commit message: Require CSRF token to edit Stripe settings - thanks to @stehled

Diff: diff --git a/post/setting.php b/post/setting.php
index 3df54650..25e59e1e 100644
--- a/post/setting.php
+++ b/post/setting.php
@@ -329,10 +329,11 @@ if (isset($_GET['generate_cron_key'])) {
 
 }
 
 if (isset($_POST['edit_online_payment_settings'])) {
 
+    validateCSRFToken($_POST['csrf_token']);
     validateAdminRole();
 
     $config_stripe_enable = intval($_POST['config_stripe_enable']);
     $config_stripe_publishable = sanitizeInput($_POST['config_stripe_publishable']);
     $config_stripe_secret = sanitizeInput($_POST['config_stripe_secret']);
diff --git a/settings_online_payment.php b/settings_online_payment.php
index f8eb017e..e9e0157f 100644
--- a/settings_online_payment.php
+++ b/settings_online_payment.php
@@ -9,10 +9,11 @@ require_once "inc_all_settings.php";
         <div class="card-header py-3">
             <h3 class="card-title"><i class="fas fa-fw fa-credit-card mr-2"></i>Online Payment</h3>
         </div>
         <div class="card-body">
             <form action="post.php" method="post" autocomplete="off">
+                <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
 
                 <div class="form-group">
                     <div class="custom-control custom-switch">
                         <input type="checkbox" class="custom-control-input" name="config_stripe_enable" <?php if ($config_stripe_enable == 1) { echo "checked"; } ?> value="1" id="enableStripeSwitch">
                         <label class="custom-control-label" for="enableStripeSwitch">Enable Stripe</label>
@@ -51,13 +52,13 @@ require_once "inc_all_settings.php";
                                 <option value="">- Account -</option>
                                 <?php
                                 $sql_accounts = mysqli_query($mysqli, "SELECT * FROM accounts LEFT JOIN account_types ON account_types.account_type_id = accounts.account_type WHERE account_type_parent = 1 AND account_archived_at IS NULL ORDER BY account_name ASC");
                                 while ($row = mysqli_fetch_array($sql_accounts)) {
                                     $account_id = intval($row['account_id']);
-                                    $account_name = nullable_htmlentities($row['account_name']); 
+                                    $account_name = nullable_htmlentities($row['account_name']);
                                     ?>
-                                        
+
                                     <option value="<?php echo $account_id ?>" <?php if ($account_id == $config_stripe_account) { echo "selected"; } ?>><?php echo $account_name ?></option>
                                 <?php
                                 }
                                 ?>
                             </select>

Vulnerable code:                                     $account_name = nullable_htmlentities($row['account_name']); 
                                        
Fixed code:     validateCSRFToken($_POST['csrf_token']);
                <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
                                    $account_name = nullable_htmlentities($row['account_name']);