CVE-2013-5313 (PHP, published 2013-08-19T21:10Z)
Description: value: Cross-site request forgery (CSRF) vulnerability in core/admin/modules/users/update.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to hijack the authentication of administrators for requests that modify arbitrary user accounts via an edit user action.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/bigtreecms/BigTree-CMS
Files changed:
core/admin/modules/users/create.php
core/admin/modules/users/update.php
Commit message: Fixed a Cross-Site Request Forgery exploit that would allow logged-in BigTree admins hitting a malicious page to automatically create / update users.


Vulnerable code:
	$admin->requireLevel(1);
	$id = $admin->createUser($_POST);	
	if (!$id) {
		$_SESSION["bigtree_admin"]["create_user"] = $_POST;
		$admin->growl("Users","Creation Failed","error");
		BigTree::redirect(ADMIN_ROOT."users/add/");

	$admin->growl("Users","Added User");
	BigTree::redirect(ADMIN_ROOT."users/edit/$id/");
	$perms = json_decode($_POST["permissions"],true);
	$_POST["permissions"] = array("page" => $perms["Page"],"module" => $perms["Module"],"resources" => $perms["Resource"],"module_gbp" => $perms["ModuleGBP"]);
	$_POST["alerts"] = json_decode($_POST["alerts"],true);
	$success = $admin->updateUser($_POST["id"],$_POST);
	
	if (!$success) {
		$_SESSION["bigtree_admin"]["update_user"] = $_POST;
		$admin->growl("Users","Update Failed","error");
		BigTree::redirect(ADMIN_ROOT."users/edit/".end($bigtree["path"])."/");
	
	$admin->growl("Users","Updated User");
	
	BigTree::redirect(ADMIN_ROOT."users/");

Fixed code:
	if ($_SERVER["HTTP_REFERER"] != ADMIN_ROOT."users/add/") {
?>
<div class="container">
	<section>
		<p>To create a user, please access the <a href="<?=ADMIN_ROOT?>users/add/">Add User</a> page.</p>
	</section>
</div>
<?
	} else {
		$admin->requireLevel(1);
		$id = $admin->createUser($_POST);	
		
		if (!$id) {
			$_SESSION["bigtree_admin"]["create_user"] = $_POST;
			$admin->growl("Users","Creation Failed","error");
			BigTree::redirect(ADMIN_ROOT."users/add/");
		}
		$admin->growl("Users","Added User");
		BigTree::redirect(ADMIN_ROOT."users/edit/$id/");
	if ($_SERVER["HTTP_REFERER"] != ADMIN_ROOT."users/edit/".$_POST["id"]."/") {
?>
<div class="container">
	<section>
		<p>To update a user, please access the <a href="<?=ADMIN_ROOT?>users/edit/<?=$_POST["id"]?>/">Edit User</a> page.</p>
	</section>
</div>
<?
	} else {
		$perms = json_decode($_POST["permissions"],true);
		$_POST["permissions"] = array("page" => $perms["Page"],"module" => $perms["Module"],"resources" => $perms["Resource"],"module_gbp" => $perms["ModuleGBP"]);
		$_POST["alerts"] = json_decode($_POST["alerts"],true);
		$success = $admin->updateUser($_POST["id"],$_POST);
		
		if (!$success) {
			$_SESSION["bigtree_admin"]["update_user"] = $_POST;
			$admin->growl("Users","Update Failed","error");
			BigTree::redirect(ADMIN_ROOT."users/edit/".end($bigtree["path"])."/");
		}
		
		$admin->growl("Users","Updated User");
		
		BigTree::redirect(ADMIN_ROOT."users/");