CVE-2017-8098: Cross-Site Request Forgery (CSRF) (CWE-352)
value: e107 2.1.4 is vulnerable to cross-site request forgery in plugin-installing, meta-changing, and settings-changing. A malicious web page can use forged requests to make e107 download and install a plug-in provided by the attacker.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 6.5
Published: 2017-04-24T18:59Z
Repository: https://github.com/e107inc/e107
Language: PHP
Files changed: e107_admin/frontpage.php, e107_admin/meta.php, e107_admin/plugin.php, e107_admin/prefs.php
Commit date: 2017-03-02 12:51:03 -0800
Commit message: Token fixes.

Diff: diff --git a/e107_admin/frontpage.php b/e107_admin/frontpage.php
index 37a92e4ed..453ea97d6 100644
--- a/e107_admin/frontpage.php
+++ b/e107_admin/frontpage.php
@@ -16,10 +16,14 @@
  *	@package	e107
  *	@subpackage	admin
  *	@version 	$Id$;
  */
 
+if(!empty($_POST) && !isset($_POST['e-token']))
+{
+	$_POST['e-token'] = '';
+}
 require_once ('../class2.php');
 if(! getperms('G'))
 {
 	e107::redirect('admin');
 	exit();
@@ -390,10 +394,11 @@ class frontpage
 		$frm = e107::getForm();
 		// List of current settings
 		$show_legend = $show_button ? " class='e-hideme'" : '';
 		$text = "
 		<form method='post' action='".e_SELF."'>
+		<input type='hidden' name='e-token' value='".e_TOKEN."' />
 			<fieldset id='frontpage-settings'>
 				<legend{$show_legend}>".FRTLAN_13."</legend>
 
 				<table class='table adminlist'>
 					<colgroup>
@@ -492,11 +497,13 @@ class frontpage
 		}
 
 // <legend class='e-hideme'>".($rule_info['order'] ? FRTLAN_46 : FRTLAN_42)."</legend>
 
 		$text = "
-		<form method='post' action='".e_SELF."'>";
+		<form method='post' action='".e_SELF."'>
+		<input type='hidden' name='e-token' value='".e_TOKEN."' />
+		";
 		
 		$text .= '<ul class="nav nav-tabs" id="myTabs">
 			<li class="active"><a data-toggle="tab" href="#home">'.FRTLAN_49.'</a></li>
 			<li><a data-toggle="tab" href="#postlogin">'.FRTLAN_35.'</a></li>
 			</ul>
diff --git a/e107_admin/meta.php b/e107_admin/meta.php
index 8ea8cfdbf..88e599044 100644
--- a/e107_admin/meta.php
+++ b/e107_admin/meta.php
@@ -8,10 +8,14 @@
  *
  * Administration Area - Meta Tags
  *
  *
 */
+if(!empty($_POST) && !isset($_POST['e-token']))
+{
+	$_POST['e-token'] = '';
+}
 require_once("../class2.php");
 
 if (!getperms("T")) 
 {
 	e107::redirect('admin');
@@ -126,10 +130,11 @@ $text = "
 				</tbody>
 			</table>
 			<div class='buttons-bar center'>".
 				$frm->admin_button('metasubmit','no-value','update', LAN_UPDATE)."
 			</div>
+			<input type='hidden' name='e-token' value='".e_TOKEN."' />
 		</fieldset>
 	</form>
 ";
 
 $ns->tablerender(METLAN_00." (".e_LANGUAGE.")", $mes->render().$text);
diff --git a/e107_admin/plugin.php b/e107_admin/plugin.php
index b87329363..048d28710 100644
--- a/e107_admin/plugin.php
+++ b/e107_admin/plugin.php
@@ -210,11 +210,10 @@ class plugin_ui extends e_admin_ui
 			{
 				e107::getPlug()->clearCache();
 			}
 
 
-
 			if($this->getMode()=== 'avail')
 			{
 				$this->listQry  = "SELECT * FROM `#plugin` WHERE plugin_installflag = 0 AND plugin_category != 'menu'  ";
 			}
 
@@ -395,11 +394,14 @@ class plugin_ui extends e_admin_ui
 				return $this->pluginConfirmUninstall($plug_vars);
 			}
 
 			$post = e107::getParser()->filter($_POST);
 
-
+			if(empty($_POST['e-token']))
+			{
+				return false;
+			}
 
 		//	$id = e107::getPlugin
 
 			$text = e107::getPlugin()->uninstall($id, $post);
 
@@ -809,17 +811,19 @@ class plugin_ui extends e_admin_ui
 			$text .= "<input class='btn' type='submit' name='uninstall_confirm' value=\"".EPL_ADLAN_3."\" />&nbsp;&nbsp;
 			<input class='btn' type='submit' name='uninstall_cancel' value='".EPL_ADLAN_62."' onclick=\"location.href='".e_SELF."'; return false;\"/>";
 			*/
              //   $frm->admin_button($name, $value, $action = 'submit', $label = '', $options = array());
 
-			$text .= "</div>
+
+
+			$text .= "<input type='hidden' name='e-token' value='".e_TOKEN."' /></div>
 			</fieldset>
 			</form>
 			";
 
 			return $text;
-			e107::getRender()->tablerender(EPL_ADLAN_63.SEP.$tp->toHtml($plug_vars['@attributes']['name'], "", "defs,emotes_off, no_make_clickable"),$mes->render(). $text);
+		//	e107::getRender()->tablerender(EPL_ADLAN_63.SEP.$tp->toHtml($plug_vars['@attributes']['name'], "", "defs,emotes_off, no_make_clickable"),$mes->render(). $text);
 
 		}
 	/*
 		// optional - a custom page.
 		public function customPage()
diff --git a/e107_admin/prefs.php b/e107_admin/prefs.php
index 915a8efe9..d1252d7ad 100644
--- a/e107_admin/prefs.php
+++ b/e107_admin/prefs.php
@@ -8,10 +8,14 @@
  *
  * Administration - Site Preferences
  *
  */
 
+if(!empty($_POST) && !isset($_POST['e-token']))
+{
+	$_POST['e-token'] = '';
+}
 require_once ("../class2.php");
 
 if(isset($_POST['newver']))
 {
 	header("location:http://e107.org/index.php");
@@ -307,10 +311,11 @@ closedir($handle);
 $pref['membersonly_exceptions'] = implode("\n",$pref['membersonly_exceptions']);
 
 $text = "
 <div id='core-prefs'>
 	<form class='admin-menu' method='post' action='".e_SELF."' autocomplete='off'>
+	<input type='hidden' name='e-token' value='".e_TOKEN."' />
 		<fieldset id='core-prefs-main'>
 			<legend>".PRFLAN_1."</legend>
 			<table class='table adminform'>
 				<colgroup>
 					<col class='col-label' />

Vulnerable code: 		<form method='post' action='".e_SELF."'>";


			$text .= "</div>
			e107::getRender()->tablerender(EPL_ADLAN_63.SEP.$tp->toHtml($plug_vars['@attributes']['name'], "", "defs,emotes_off, no_make_clickable"),$mes->render(). $text);
Fixed code: if(!empty($_POST) && !isset($_POST['e-token']))
{
	$_POST['e-token'] = '';
}
		<input type='hidden' name='e-token' value='".e_TOKEN."' />
		<form method='post' action='".e_SELF."'>
		<input type='hidden' name='e-token' value='".e_TOKEN."' />
		";
if(!empty($_POST) && !isset($_POST['e-token']))
{
	$_POST['e-token'] = '';
}
			<input type='hidden' name='e-token' value='".e_TOKEN."' />
			if(empty($_POST['e-token']))
			{
				return false;
			}


			$text .= "<input type='hidden' name='e-token' value='".e_TOKEN."' /></div>
		//	e107::getRender()->tablerender(EPL_ADLAN_63.SEP.$tp->toHtml($plug_vars['@attributes']['name'], "", "defs,emotes_off, no_make_clickable"),$mes->render(). $text);
if(!empty($_POST) && !isset($_POST['e-token']))
{
	$_POST['e-token'] = '';
}
	<input type='hidden' name='e-token' value='".e_TOKEN."' />