CVE-2024-25344 (PHP, published 2024-02-26T16:27Z)
Description: value: Cross Site Scripting vulnerability in ITFlow.org before commit v.432488eca3998c5be6b6b9e8f8ba01f54bc12378 allows a remtoe attacker to execute arbitrary code and obtain sensitive information via the settings.php, settings+company.php, settings_defaults.php,settings_integrations.php, settings_invoice.php, settings_localization.php, settings_mail.php components.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/itflow-org/itflow
Files changed:
post/setting.php
post/tax.php
settings_alerts.php
settings_backup.php
settings_company.php
settings_defaults.php
settings_integrations.php
settings_invoice.php
settings_localization.php
settings_mail.php
settings_modules.php
settings_quote.php
settings_security.php
settings_tax_add_modal.php
settings_tax_edit_modal.php
settings_taxes.php
settings_telemetry.php
settings_theme.php
settings_ticket.php
Commit message: Require CSRF token to edit more admin settings - thanks again to @stehled


Vulnerable code:
            <a class="btn btn-primary btn-lg p-3" href="post.php?download_database"><i class="fas fa-fw fa-4x fa-download"></i><br><br>Download</a>
                            <option <?php if ($start_page_value == $config_start_page) { echo "selected"; } ?> 
</div>
          
          
          
        
</div>
    $mysqli, 
                                        <a class="dropdown-item text-danger confirm-link" href="post.php?archive_tax=<?php echo $tax_id; ?>">

Fixed code:
    validateCSRFToken($_POST['csrf_token']);
    validateCSRFToken($_POST['csrf_token']);
    validateCSRFToken($_POST['csrf_token']);
    validateCSRFToken($_POST['csrf_token']);
    validateCSRFToken($_POST['csrf_token']);
    validateCSRFToken($_POST['csrf_token']);
    validateCSRFToken($_POST['csrf_token']);
    validateCSRFToken($_POST['csrf_token']);
    validateCSRFToken($_POST['csrf_token']);
    validateCSRFToken($_POST['csrf_token']);
    validateCSRFToken($_POST['csrf_token']);
    validateCSRFToken($_POST['csrf_token']);
    validateCSRFToken($_POST['csrf_token']);

    validateCSRFToken($_POST['csrf_token']);
    validateCSRFToken($_POST['csrf_token']);
    validateCSRFToken($_GET['csrf_token']);
    validateCSRFToken($_POST['csrf_token']);
    validateCSRFToken($_POST['csrf_token']);
    validateCSRFToken($_GET['csrf_token']);
                <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
            <a class="btn btn-primary btn-lg p-3" href="post.php?download_database&csrf_token=<?php echo $_SESSION['csrf_token'] ?>"><i class="fas fa-fw fa-4x fa-download"></i><br><br>Download</a>
                <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
            <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
                            <option <?php if ($start_page_value == $config_start_page) { echo "selected"; } ?>
                <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
                <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
                <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
                <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
                <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
                <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">

                <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">

                <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">

                <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
                <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
                <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
        <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">

</div>
        <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">





</div>
    $mysqli,
                                        <a class="dropdown-item text-danger confirm-link" href="post.php?archive_tax=<?php echo $tax_id; ?>&csrf_token=<?php echo $_SESSION['csrf_token'] ?>">
                <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
                <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
                <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">