inspirer/mibew — Issue #8: [security] CSRF-vulnerability in `<form ...>...</form>`
Author: polymorphm
Created: 2011-10-19 15:06:20+00:00
State: open

good day!

`

...

` of this system -- now not checks for CSRF :-(

this means for example:
an attacker can gain access via CSRF-vulnerable - on the page /webim/operator/operator.php (*tested mibew version was 1.6.4*)

I see the solution of the problem as:

* [simple solution]: check all POST-requests (on all PHP-pages) for valid HTTP_REFERER
* [difficult solution, but better]: check all POST-requests (on all PHP-pages) for valid CSRF-token.

thanks in advance!