CVE-2023-40172 (PHP, published 2023-08-18T22:15Z)
Description: value: Social media skeleton is an uncompleted/framework social media project implemented using a php, css ,javascript and html. A Cross-site request forgery (CSRF) attack is a type of malicious attack whereby an attacker tricks a victim into performing an action on a website that they do not intend to do. This can be done by sending the victim a malicious link or by exploiting a vulnerability in the website. Prior to version 1.0.5 Social media skeleton did not properly restrict CSRF attacks. This has been addressed in version 1.0.5 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/fobybus/social-media-skeleton
Files changed:
admin/adminlogin.html
admin/atask/add.php
admin/atask/setting.php
admin/home.php
admin/login.php
admin/mg.php
login.php
tasks/passw.php
user/home.js
user/setting.html
user/setting.php
Commit message: fixed csrf bug,improved admin/atask/setting.php and added passw.php


Vulnerable code:
					<input class="inputf" type="email" name="email"> <br>
					<input class="inputf" type="password" name="password">

<html lang="en-us">

    <head>
        <title> admin homepage </title>
        <meta charset="utf-8">
        <meta name="viewport" content="width=device-width,intial-scale=1.0">
        <meta name="keywords"
            content="social media,the best social media platform,chat with your friend ,easy social media,pipago">
        <meta name="description" content="light weight secured student's social media!!!">
        <meta name="author" content="black eagle team">
        <link rel="stylesheet" href="../home.css">
    </head>
    <!-- body goes here -->
    
    <body>
        <!--header-->
        <header>
            <!-- -navigation links-->
            <nav>
    
                <ul>
                    <li><a href="../home.php">pipa analytics</a></li>
                    <li><a href="../mg.php" >manage user </a></li>
                    <li><a href="#" style="background-color: black;"> add admin </a></li>
                    <li><a href="setting.php">setting</a></li>
                    <li><a href="logout.php">logout</a></li>
                </ul>
    
            </nav>
    
        </header>
        <!-- content-->
        <main>
      <div class="addbox">
    <form class="adform" action="add.php" method="POST">
    <label>email</label><br>
    <input type="email" name="email"><br>
    <label>password</label><br>
    <input type="password" name="password">
    <input class="addbutton" type="submit" value="add">
    </form>
    
      </div>
        </main>
        <!--footer content-->
        <footer>
    
    
        </footer>
    </body>
    
    </html>
	header("location:adminlogin.html");
$uemail=htmlspecialchars($_POST["email"], ENT_QUOTES, 'UTF-8');
$upass=htmlspecialchars($_POST["password"], ENT_QUOTES, 'UTF-8');
//if empty password or username!
//alt isempty
if($uemail=="" || $upass=="")
  header("location:add.html");
  exit();
}
require("../../tasks/condb.php");

// Create a prepared statement to prevent SQL injection
$query = "INSERT INTO admin (email, password) VALUES (?, ?)";
$stmt = mysqli_prepare($dbcon, $query);
mysqli_stmt_bind_param($stmt, "ss", $uemail, $upass);
$result = mysqli_stmt_execute($stmt);
if($result)
{
  echo("<p style='color:green;position:absolute;left:250px;top:70px'> successfully added $uemail</p>");
 include("add.html");
  exit();
}  else {
echo("some thing want wrong please try again!");
$dbcon->close();
include("add.html");

	if(isset($_POST['email']))
	if(isset($_POST['password']))
	$newpass=htmlspecialchars($_POST['password'], ENT_QUOTES, 'UTF-8');
	if(isset($_POST['oldpass']))
		$oldpass=htmlspecialchars($_POST['oldpass'], ENT_QUOTES, 'UTF-8');
// SQLi prevention through parameterization
$id = $_SESSION["aid"];
$q = "SELECT * FROM admin WHERE admin_id=?";
$stmt = mysqli_prepare($dbcon, $q);
mysqli_stmt_bind_param($stmt, "i", $id);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);
$row = $result->fetch_assoc(); 
$rpass = $row["password"];  //real
				<li><a href="add.html"> add admin </a></li>
    <input type="email" name="email" required><br>
	<input type="password" name="password" required><br>
				<li><a href="atask/add.html"> add admin </a></li>
if(!isset($_POST["email"]));
  $dbcon->close();
    exit;
  $dbcon->close();
    echo "<p style='color:red;text-align:center;font-size:20px;position: absolute;left:700px;top:250px;'> incorrect password or email  </p>";
    exit();
                <li><a href="atask/add.html"> add admin </a></li>
    echo "<p style='color:red;text-align:center;font-size:20px;position: absolute;left:700px;top:250px;'> incorrect password or email  </p>";

Fixed code:
					<input class="inputf" type="email" name="email" required> <br>
					<input class="inputf" type="password" name="password" required>
require("../../tasks/passw.php");
	header("location:../adminlogin.html");
if($_SERVER['REQUEST_METHOD'] == 'POST')
  $uemail=htmlspecialchars($_POST["email"], ENT_QUOTES, 'UTF-8');
  $upass=$_POST["password"];
     //check token 
     if(isset($_SESSION["c-token"]) && isset($_POST["csrf-token"]))
     {
       $tok=$_POST["csrf-token"];
       if($_SESSION["c-token"]!=$tok)
       {
         exit("action denied!");
       }
     } else {
         exit("action denied!");
     }
    
  //if empty password or username!
  //alt isempty
  if($uemail=="" || $upass=="")
  {
    header("location:add.php");
    exit();
  }
  require("../../tasks/condb.php");
  
  // Create a prepared statement to prevent SQL injection
  $query = "INSERT INTO admin (email, password) VALUES (?, ?)";
  $stmt = mysqli_prepare($dbcon, $query);
  mysqli_stmt_bind_param($stmt, "ss", $uemail, $upass);
  $result = mysqli_stmt_execute($stmt);
  
  if($result)
  {
    echo("<p style='color:green;position:absolute;left:250px;top:70px'> successfully added $uemail</p>");
    $dbcon->close();
  }  else {
  echo("some thing want wrong please try again!");
  }
//gen ctoken
$tok=$_SESSION["c-token"]=generateSalt();





<html lang="en-us">

    <head>
        <title> admin homepage </title>
        <meta charset="utf-8">
        <meta name="viewport" content="width=device-width,initial-scale=1.0">
        <meta name="keywords"
            content="social media,the best social media platform,chat with your friend ,easy social media,pipago">
        <meta name="description" content="light weight secured student's social media!!!">
        <meta name="author" content="black eagle team">
        <link rel="stylesheet" href="../home.css">
    </head>
    <!-- body goes here -->
    
    <body>
        <!--header-->
        <header>
            <!-- -navigation links-->
            <nav>
    
                <ul>
                    <li><a href="../home.php">pipa analytics</a></li>
                    <li><a href="../mg.php" >manage user </a></li>
                    <li><a href="#" style="background-color: black;"> add admin </a></li>
                    <li><a href="setting.php">setting</a></li>
                    <li><a href="logout.php">logout</a></li>
                </ul>
    
            </nav>
    
        </header>
        <!-- content-->
        <main>
      <div class="addbox">
    <form class="adform" action="add.php" method="POST">
    <label>email</label><br>
    <input type="email" name="email" required><br>
    <label>password</label><br>
    <input type="password" name="password" required>
    <input type="text" name="csrf-token" value="<?php echo $tok; ?>" hidden>
    <input class="addbutton" type="submit" value="add">
    </form>
    
      </div>
        </main>
        <!--footer content-->
        <footer>
    
    
        </footer>
    </body>
    
    </html>
	if(isset($_POST['email']) && $_POST['email']!="")
	if(isset($_POST['password']) && $_POST['password']!="")
	$newpass=$_POST['password'];
	if(isset($_POST['oldpass']) && $_POST['oldpass']!="")
		$oldpass=$_POST['oldpass'];
$id=$_SESSION["aid"];
$rpass = $_SESSION["password"];  //actual pass
	$_SESSION["password"]=$newpass;
} 

if (($pchanged && $oldpass != $rpass) || ($echanged && $oldpass != $rpass)) {
    echo "incorrect attempt! <br>";
$dbcon->close();
				<li><a href="add.php"> add admin </a></li>
    <input type="email" name="email"  placeholder="unchanged"><br>
	<input type="password" name="password" placeholder="unchanged"><br>
				<li><a href="atask/add.php"> add admin </a></li>
if(!isset($_POST["email"]))
  $_SESSION["password"]=$rows["password"];
    echo "<p style='color:red;text-align:center;font-size:20px;'> incorrect password or email  </p>";
$dbcon->close();
                <li><a href="atask/add.php"> add admin </a></li>
    echo "<p style='color:red;text-align:center;font-size:20px;'> incorrect password or email  </p>";
<?php

//generate salt 
function generateSalt()
{
  $randb=random_bytes(16);
  return bin2hex($randb);
}

//hash password 
function hashPass($plain,$salt)
{
    $password=$plain.$salt;
    return hash("sha256",$password);
}

?>
//set token 
function setToken(token)
{
  document.getElementById("csrf-token").setAttribute("value",token);
}

		<input type="text" name="csrf-token" id="csrf-token" hidden>
require("../tasks/passw.php");
   
    //check token 
    if(isset($_SESSION["c-token"]) && isset($_POST["csrf-token"]))
    {
      $tok=$_POST["csrf-token"];
      if($_SESSION["c-token"]!=$tok)
      {
        exit("action denied!");
      }
    } else {
        exit("action denied!");
    }
   
    
$tok=$_SESSION["c-token"]=generateSalt();
echo "<script>setToken('$tok')</script>";