Vulnerability: In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.ratings.php.
Vulnerability ID: CVE-2017-15730
CWE: CWE-352
Severity score: 6.4
Project: https://github.com/thorsten/phpMyFAQ
Published: 2017-10-22
File: phpmyfaq/admin/stat.ratings.php
Commit message: Fixed possible direct calls
Commit author: Thorsten Rinne

Vulnerable version (before fix):
                     <i aria-hidden="true" class="fa fa-tasks"></i> <?php echo $PMF_LANG['ad_rs'] ?>                      <div class="pull-right">                         <a class="btn btn-danger" href="?action=clear-statistics">                             <i aria-hidden="true" class="fa fa-trash"></i> <?php echo $PMF_LANG['ad_delete_all_votings'] ?>                         </a>                     </div>         </header>  <?php     if ('clear-statistics' === $action) {         if ($ratings->deleteAll()) {             echo '<p class="alert alert-success">Statistics successfully deleted.</p>';         } else {

Fixed version (after fix):
                     <i aria-hidden="true" class="fa fa-tasks"></i> <?php echo $PMF_LANG['ad_rs'] ?>                      <div class="pull-right">                         <a class="btn btn-danger"                             href="?action=clear-statistics&csrf=<?php echo $user->getCsrfTokenFromSession() ?>">                             <i aria-hidden="true" class="fa fa-trash"></i> <?php echo $PMF_LANG['ad_delete_all_votings'] ?>                         </a>                     </div>         </header>  <?php     $csrfToken = PMF_Filter::filterInput(INPUT_GET, 'csrf', FILTER_SANITIZE_STRING);      if (!isset($_SESSION['phpmyfaq_csrf_token']) || $_SESSION['phpmyfaq_csrf_token'] !== $csrfToken) {         $clearStatistics = false;     } else {         $clearStatistics = true;     }      if ('clear-statistics' === $action && $clearStatistics) {         if ($ratings->deleteAll()) {             echo '<p class="alert alert-success">Statistics successfully deleted.</p>';         } else {

Patch:
patch: @@ -41,7 +41,8 @@
                     <i aria-hidden="true" class="fa fa-tasks"></i> <?php echo $PMF_LANG['ad_rs'] ?>
 
                     <div class="pull-right">
-                        <a class="btn btn-danger" href="?action=clear-statistics">
+                        <a class="btn btn-danger" 
+                           href="?action=clear-statistics&csrf=<?php echo $user->getCsrfTokenFromSession() ?>">
                             <i aria-hidden="true" class="fa fa-trash"></i> <?php echo $PMF_LANG['ad_delete_all_votings'] ?>
                         </a>
                     </div>
@@ -50,7 +51,15 @@
         </header>
 
 <?php
-    if ('clear-statistics' === $action) {
+    $csrfToken = PMF_Filter::filterInput(INPUT_GET, 'csrf', FILTER_SANITIZE_STRING);
+
+    if (!isset($_SESSION['phpmyfaq_csrf_token']) || $_SESSION['phpmyfaq_csrf_token'] !== $csrfToken) {
+        $clearStatistics = false;
+    } else {
+        $clearStatistics = true;
+    }
+
+    if ('clear-statistics' === $action && $clearStatistics) {
         if ($ratings->deleteAll()) {
             echo '<p class="alert alert-success">Statistics successfully deleted.</p>';
         } else {
path: phpmyfaq/admin/stat.ratings.php