CVE-2016-9455 (PHP, published 2017-03-28T02:59Z)
Description: value: Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery (CSRF). A number of scripts in Revive Adserver's user interface are vulnerable to CSRF attacks: `www/admin/banner-acl.php`, `www/admin/banner-activate.php`, `www/admin/banner-advanced.php`, `www/admin/banner-modify.php`, `www/admin/banner-swf.php`, `www/admin/banner-zone.php`, `www/admin/tracker-modify.php`.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/revive-adserver/revive-adserver
Files changed:
www/admin/banner-acl.php
www/admin/banner-activate.php
www/admin/banner-advanced.php
www/admin/banner-modify.php
www/admin/banner-swf.php
www/admin/banner-zone.php
www/admin/tracker-modify.php
Commit message: Fix h1 report 97123

Cross-Site Request Forgery (CSRF)
---------------------------------

The HackerOne user @decidedlygray has reported a number of scripts in Revive
Adserver's user interface that were vulnerable to CSRF attacks:

- www/admin/banner-acl.php
- www/admin/banner-activate.php
- www/admin/banner-advanced.php
- www/admin/banner-modify.php
- www/admin/banner-swf.php
- www/admin/banner-zone.php
- www/admin/tracker-modify.php

A CVE-ID has been requested, but not assigned yet.

CWE: CWE-352
CVSSv2: 5 (AV:N/AC:L/Au:N/C:N/I:N/A:P)


Vulnerable code:
    if (isset($bannerid) && $bannerid != '') {
        // Update banner
        $doBanners = OA_Dal::factoryDO('banners');
        $doBanners->get($bannerid);
        $doBanners->prepend = $prepend;
        $doBanners->append  = $append;
        $doBanners->update();

        // Queue confirmation message
        $translation = new OX_Translation();
        $translated_message = $translation->translate($GLOBALS['strBannerAdvancedHasBeenUpdated'], array(
            MAX::constructURL(MAX_URL_ADMIN, 'banner-edit.php?clientid=' .  $clientid . '&campaignid=' . $campaignid . '&bannerid=' . $bannerid),
            htmlspecialchars($doBanners->description)
        ));
        OA_Admin_UI::queueMessage($translated_message, 'local', 'confirm', 0);
    }

Fixed code:
    OA_Permission::checkSessionToken();

OA_Permission::checkSessionToken();

    OA_Permission::checkSessionToken();

    // Update banner
    $doBanners = OA_Dal::factoryDO('banners');
    $doBanners->get($bannerid);
    $doBanners->prepend = $prepend;
    $doBanners->append  = $append;
    $doBanners->update();

    // Queue confirmation message
    $translation = new OX_Translation();
    $translated_message = $translation->translate($GLOBALS['strBannerAdvancedHasBeenUpdated'], array(
        MAX::constructURL(MAX_URL_ADMIN, 'banner-edit.php?clientid=' .  $clientid . '&campaignid=' . $campaignid . '&bannerid=' . $bannerid),
        htmlspecialchars($doBanners->description)
    ));

    OA_Admin_UI::queueMessage($translated_message, 'local', 'confirm', 0);

    exit;
OA_Permission::checkSessionToken();
    OA_Permission::checkSessionToken();

OA_Permission::checkSessionToken();

    OA_Permission::checkSessionToken();