CVE-2018-1000053: Cross-Site Request Forgery (CSRF) (CWE-352)
value: LimeSurvey version 3.0.0-beta.3+17110 contains a Cross ite Request Forgery (CSRF) vulnerability in Theme Uninstallation that can result in CSRF causing LimeSurvey admins to delete all their themes, rendering the website unusable. This attack appear to be exploitable via Simple HTML markup can be used to send a GET request to the affected endpoint.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 8.8
Published: 2018-02-09T23:29Z
Repository: https://github.com/LimeSurvey/LimeSurvey
Language: PHP
Files changed: application/controllers/admin/themeoptions.php, application/models/TemplateConfiguration.php
Commit date: 2018-01-24 15:26:04 +0100
Commit message: Fixed issue: no CRSF check for uninstall theme, reported by MUSTAFA HASAN


Diff: diff --git a/application/controllers/admin/themeoptions.php b/application/controllers/admin/themeoptions.php
index a7a9f36528..62941895d9 100644
--- a/application/controllers/admin/themeoptions.php
+++ b/application/controllers/admin/themeoptions.php
@@ -231,12 +231,13 @@ class themeoptions  extends Survey_Common_Action
             $this->getController()->redirect(array("admin/themeoptions"));
         }
 
     }
 
-    public function uninstall($templatename)
+    public function uninstall()
     {
+        $templatename = Yii::app()->request->getPost('templatename');
         if (Permission::model()->hasGlobalPermission('templates', 'update')) {
             if (!Template::hasInheritance($templatename)) {
                 TemplateConfiguration::uninstall($templatename);
             } else {
                 Yii::app()->setFlashMessage(sprintf(gT("You can't uninstall template '%s' because some templates inherit from it."), $templatename), 'error');
@@ -260,16 +261,16 @@ class themeoptions  extends Survey_Common_Action
         }
     }
 
     public function getPreviewTag()
     {
-        $templatename = Yii::app()->request->getPost('templatename');        
+        $templatename = Yii::app()->request->getPost('templatename');
         $oTemplate = TemplateConfiguration::getInstanceFromTemplateName($templatename);
         $previewTag = $oTemplate->getPreview();
         return Yii::app()->getController()->renderPartial(
             '/admin/super/_renderJson',
-            ['data' => ['image' =>  $previewTag]], 
+            ['data' => ['image' =>  $previewTag]],
             false,
             false
         );
     }
 
diff --git a/application/models/TemplateConfiguration.php b/application/models/TemplateConfiguration.php
index 23b0864d07..dd270338d5 100755
--- a/application/models/TemplateConfiguration.php
+++ b/application/models/TemplateConfiguration.php
@@ -509,11 +509,11 @@ class TemplateConfiguration extends TemplateConfig
             $sOptionUrl    = Yii::app()->getController()->createUrl('admin/themeoptions/sa/updatesurveygroup', array("id"=>$this->id, "gsid"=>$gisd));
         } else {
             $sOptionUrl    = Yii::app()->getController()->createUrl('admin/themeoptions/sa/update', array("id"=>$this->id));
         }
 
-        $sUninstallUrl = Yii::app()->getController()->createUrl('admin/themeoptions/sa/uninstall/', array("templatename"=>$this->template_name));
+        $sUninstallUrl = Yii::app()->getController()->createUrl('admin/themeoptions/sa/uninstall/');
 
         $sEditorLink = "<a
             id='template_editor_link_".$this->template_name."'
             href='".$sEditorUrl."'
             class='btn btn-default btn-block'>
@@ -536,11 +536,13 @@ class TemplateConfiguration extends TemplateConfig
                 </a>";
         }
 
         $sUninstallLink = '<a
             id="remove_fromdb_link_'.$this->template_name.'"
-            data-href="'.$sUninstallUrl.'"
+            data-ajax-url="'.$sUninstallUrl.'"
+            data-post=\'{ "templatename": "'.$this->template_name.'" }\'
+            data-gridid = "yw0"
             data-target="#confirmation-modal"
             data-toggle="modal"
             data-message="'.gT('This will delete all the specific configurations of this theme.').'<br>'.gT('Do you want to continue?').'"
             data-tooltip="true"
             data-title="'.gT('Uninstall this theme').'"

Vulnerable code:     public function uninstall($templatename)
        $templatename = Yii::app()->request->getPost('templatename');        
            ['data' => ['image' =>  $previewTag]], 
        $sUninstallUrl = Yii::app()->getController()->createUrl('admin/themeoptions/sa/uninstall/', array("templatename"=>$this->template_name));
            data-href="'.$sUninstallUrl.'"
Fixed code:     public function uninstall()
        $templatename = Yii::app()->request->getPost('templatename');
        $templatename = Yii::app()->request->getPost('templatename');
            ['data' => ['image' =>  $previewTag]],
        $sUninstallUrl = Yii::app()->getController()->createUrl('admin/themeoptions/sa/uninstall/');
            data-ajax-url="'.$sUninstallUrl.'"
            data-post=\'{ "templatename": "'.$this->template_name.'" }\'
            data-gridid = "yw0"