CVE-2015-1583: Cross-Site Request Forgery (CSRF) (CWE-352)
value: Multiple cross-site request forgery (CSRF) vulnerabilities in ATutor 2.2 allow remote attackers to hijack the authentication of administrators for requests that (1) create an administrator account via a request to mods/_core/users/admins/create.php or (2) create a user account via a request to mods/_core/users/create_user.php.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 8.8
Published: 2020-03-02T16:15Z
Repository: https://github.com/atutor/ATutor
Language: PHP
Files changed: include/lib/vital_funcs.inc.php, mods/_core/users/admins/create.php, mods/_core/users/create_user.php
Commit date: 2015-02-28 10:23:11 -0500
Commit message: 5566 created a more general function to check referer, and updated create user and create admin to use it

Diff: diff --git a/include/lib/vital_funcs.inc.php b/include/lib/vital_funcs.inc.php
index 7f520f3ba0..54f4600177 100644
--- a/include/lib/vital_funcs.inc.php
+++ b/include/lib/vital_funcs.inc.php
@@ -661,11 +661,27 @@ function admin_authenticate($privilege = 0, $check = false) {
 			exit;
 		}
 	}
 	return true;
 }
-
+/**
+ * Check if referer is in the $_pages array to prevent CSRF access
+ * @access public
+ * @return error message access denied
+ */
+function check_referer(){
+    global $_pages, $_base_href, $msg;
+    if(isset($_SERVER['HTTP_REFERER']) && $_SERVER['HTTP_REFERER'] !='' && $_SERVER['HTTP_REFERER'] != $_SERVER['PHP_SELF']){
+        $referer_script = preg_replace('#'.$_base_href.'#', '', $_SERVER['HTTP_REFERER']);
+        if( !in_array($_pages[$referer_script], $_pages)){
+			$msg->addError('ACCESS_DENIED');
+			require(AT_INCLUDE_PATH.'header.inc.php'); 
+			require(AT_INCLUDE_PATH.'footer.inc.php'); 
+			exit;
+        }
+    }
+}
 /**
  * Check if the give theme is a subsite customized theme. Return true if it is, otherwise, return false
  * @access public
  * @param string $theme_name
  * @return true or false
diff --git a/mods/_core/users/admins/create.php b/mods/_core/users/admins/create.php
index e8fed96c6d..ea8261b17c 100644
--- a/mods/_core/users/admins/create.php
+++ b/mods/_core/users/admins/create.php
@@ -13,17 +13,13 @@
 // $Id$
 
 define('AT_INCLUDE_PATH', '../../../../include/');
 require(AT_INCLUDE_PATH.'vitals.inc.php');
 admin_authenticate(AT_ADMIN_PRIV_ADMIN);
-if($_SERVER['HTTP_REFERER'] != $_SERVER['PHP_SELF']){
-    $referer_script = preg_replace('#'.$_base_href.'#', '', $_SERVER['HTTP_REFERER']);
-    if(!in_array($_pages[$referer_script], $_pages)){
-    echo "not a valid referer";
-    exit;
-    }
-}
+// Prevent remote access via CSRF: 5566
+// Ref include/lib/vitals-inc.php
+check_referer();
 
 if (isset($_POST['cancel'])) {
 	$msg->addFeedback('CANCELLED');
 	header('Location: index.php');
 	exit;
diff --git a/mods/_core/users/create_user.php b/mods/_core/users/create_user.php
index 12745b799a..1febd27d89 100644
--- a/mods/_core/users/create_user.php
+++ b/mods/_core/users/create_user.php
@@ -14,17 +14,12 @@
 
 define('AT_INCLUDE_PATH', '../../../include/');
 require(AT_INCLUDE_PATH.'vitals.inc.php');
 admin_authenticate(AT_ADMIN_PRIV_USERS);
 // Prevent remote access via CSRF: 5566
-if($_SERVER['HTTP_REFERER'] != $_SERVER['PHP_SELF']){
-    $referer_script = preg_replace('#'.$_base_href.'#', '', $_SERVER['HTTP_REFERER']);
-    if(!in_array($_pages[$referer_script], $_pages)){
-    echo "not a valid referer";
-    exit;
-    }
-}
+// Ref include/lib/vitals-inc.php
+check_referer();
 
 if (isset($_POST['cancel'])) {
 	header('Location: '.AT_BASE_HREF.'mods/_core/users/users.php');
 	exit;
 }

Vulnerable code: 
if($_SERVER['HTTP_REFERER'] != $_SERVER['PHP_SELF']){
    $referer_script = preg_replace('#'.$_base_href.'#', '', $_SERVER['HTTP_REFERER']);
    if(!in_array($_pages[$referer_script], $_pages)){
    echo "not a valid referer";
    exit;
    }
}
if($_SERVER['HTTP_REFERER'] != $_SERVER['PHP_SELF']){
    $referer_script = preg_replace('#'.$_base_href.'#', '', $_SERVER['HTTP_REFERER']);
    if(!in_array($_pages[$referer_script], $_pages)){
    echo "not a valid referer";
    exit;
    }
}
Fixed code: /**
 * Check if referer is in the $_pages array to prevent CSRF access
 * @access public
 * @return error message access denied
 */
function check_referer(){
    global $_pages, $_base_href, $msg;
    if(isset($_SERVER['HTTP_REFERER']) && $_SERVER['HTTP_REFERER'] !='' && $_SERVER['HTTP_REFERER'] != $_SERVER['PHP_SELF']){
        $referer_script = preg_replace('#'.$_base_href.'#', '', $_SERVER['HTTP_REFERER']);
        if( !in_array($_pages[$referer_script], $_pages)){
			$msg->addError('ACCESS_DENIED');
			require(AT_INCLUDE_PATH.'header.inc.php'); 
			require(AT_INCLUDE_PATH.'footer.inc.php'); 
			exit;
        }
    }
}
// Prevent remote access via CSRF: 5566
// Ref include/lib/vitals-inc.php
check_referer();
// Ref include/lib/vitals-inc.php
check_referer();