CVE-2023-47350 (Other, published 2023-11-22T16:15Z)
Description: value: Cross-Site Request Forgery (CSRF) vulnerability in SwiftyEdit Content Management System prior to v1.2.0, allows remote attackers to escalate privileges via the user password update functionality.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/SwiftyEdit/SwiftyEdit
Files changed:
core/functions/func_userdata.php
index.php
styles/default/templates/comment_form.tpl
styles/default/templates/download.tpl
styles/default/templates/loginbox.tpl
styles/default/templates/navigation.tpl
styles/default/templates/orders.tpl
styles/default/templates/page_psw_input.tpl
styles/default/templates/password.tpl
styles/default/templates/products-display.tpl
styles/default/templates/products-list.tpl
styles/default/templates/profile_main.tpl
styles/default/templates/registerform.tpl
styles/default/templates/search.tpl
styles/default/templates/shopping_cart_form.tpl
styles/default/templates/shopping_cart_table.tpl
styles/default/templates/sidebar-filter.tpl
styles/default/templates/statusbox.tpl
Commit message: Add a hidden CSRF token to all forms

This update fixes a vulnerability that allows a potential attacker to make changes to the database via forms. In the worst case, for example, changing passwords.
@mechaneus thank you for finding and reporting this vulnerability.


Vulnerable code:
	$token = md5(uniqid(rand(), TRUE));
	$_SESSION['token']      = $token;
	$_SESSION['token_time'] = time();
if(empty($_SESSION['visitor_csrf_token'])) {
	$_SESSION['visitor_csrf_token'] = md5(uniqid(rand(), TRUE));
	
                        <input type="hidden" name="csrf_token" value="{$csrf_token}">
                                <input type="hidden" name="csrf_token" value="{$csrf_token}">



		
</div>

<div class="search_toggle">
    <form action="{$search_uri}" method="POST" class="">
        <div class="row">
            <div class="col-md-12">
                <input class="searchbox form-control" type="text" name="s" value="{$search_string}">
            </div>
        </div>
        <hr class="shadow">
    </form>
</div>
    </div>
				<input type="hidden" name="csrf_token" value="{$smarty.session.token}">

Fixed code:
    if(empty($_SESSION['token'])) {
        $token = md5(uniqid(rand(), TRUE));
        $_SESSION['token'] = $token;
        $_SESSION['token_time'] = time();
    }
if(empty($_SESSION['token'])) {
	$_SESSION['token'] = md5(uniqid(rand(), TRUE));
    $_SESSION['token_time'] = time();
/* stop all $_POST actions if csrf token is empty or invalid */
if(!empty($_POST)) {
    if(empty($_POST['csrf_token'])) {
        die('Error: CSRF Token is empty');
    }
    if($_POST['csrf_token'] !== $_SESSION['token']) {
        die('Error: CSRF Token is invalid');
    }
}


$hidden_csrf_token = '<input type="hidden" name="csrf_token" value="'.$_SESSION['token'].'">';
$smarty->assign('hidden_csrf_token', "$hidden_csrf_token", true);

		{$hidden_csrf_token}
	{$hidden_csrf_token}
                {$hidden_csrf_token}
			{$hidden_csrf_token}
											{$hidden_csrf_token}
												{$hidden_csrf_token}
												{$hidden_csrf_token}
												{$hidden_csrf_token}
		{$hidden_csrf_token}
		{$hidden_csrf_token}
                        {$hidden_csrf_token}
            {$hidden_csrf_token}
                                {$hidden_csrf_token}
	{$hidden_csrf_token}
	{$hidden_csrf_token}
	{$hidden_csrf_token}
	{$hidden_csrf_token}
	{$hidden_csrf_token}
	{$hidden_csrf_token}
	{$hidden_csrf_token}
        {$hidden_csrf_token}
</div>
    {$hidden_csrf_token}
                            {$hidden_csrf_token}
                    {$hidden_csrf_token}
                {$hidden_csrf_token}
            {$hidden_csrf_token}
    {$hidden_csrf_token}
    </div>
				{$hidden_csrf_token}