CVE-2013-5313 (published 2013-08-19T21:10Z)

Cross-site request forgery (CSRF) vulnerability in core/admin/modules/users/update.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to hijack the authentication of administrators for requests that modify arbitrary user accounts via an edit user action.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)

Weakness information:
cwe_id: CWE-352
cwe_name: Cross-Site Request Forgery (CSRF)
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
extended_description: When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
         

Fix information:
repo_url: https://github.com/bigtreecms/BigTree-CMS
commit_details: repo_url: https://github.com/bigtreecms/BigTree-CMS
author: Tim Buckingham
author_date: 2013-07-17 11:19:11-04:00
msg: Fixed a Cross-Site Request Forgery exploit that would allow logged-in BigTree admins hitting a malicious page to automatically create / update users.
repository: repo_url: https://github.com/bigtreecms/BigTree-CMS
repo_name: bigtreecms/BigTree-CMS
repo_language: PHP
owner: bigtreecms
file_changes: filename: create.php
change_type: ModificationType.MODIFY
diff: @@ -1,13 +1,23 @@
 <?
-	$admin->requireLevel(1);
-	$id = $admin->createUser($_POST);	
+	if ($_SERVER["HTTP_REFERER"] != ADMIN_ROOT."users/add/") {
+?>
+<div class="container">
+	<section>
+		<p>To create a user, please access the <a href="<?=ADMIN_ROOT?>users/add/">Add User</a> page.</p>
+	</section>
+</div>
+<?
+	} else {
+		$admin->requireLevel(1);
+		$id = $admin->createUser($_POST);	
+		
+		if (!$id) {
+			$_SESSION["bigtree_admin"]["create_user"] = $_POST;
+			$admin->growl("Users","Creation Failed","error");
+			BigTree::redirect(ADMIN_ROOT."users/add/");
+		}
 	
-	if (!$id) {
-		$_SESSION["bigtree_admin"]["create_user"] = $_POST;
-		$admin->growl("Users","Creation Failed","error");
-		BigTree::redirect(ADMIN_ROOT."users/add/");
+		$admin->growl("Users","Added User");
+		BigTree::redirect(ADMIN_ROOT."users/edit/$id/");
 	}
-
-	$admin->growl("Users","Added User");
-	BigTree::redirect(ADMIN_ROOT."users/edit/$id/");
 ?>
\ No newline at end of file

programming_language: PHP
filename: update.php
change_type: ModificationType.MODIFY
diff: @@ -1,16 +1,26 @@
 <?
-	$perms = json_decode($_POST["permissions"],true);
-	$_POST["permissions"] = array("page" => $perms["Page"],"module" => $perms["Module"],"resources" => $perms["Resource"],"module_gbp" => $perms["ModuleGBP"]);
-	$_POST["alerts"] = json_decode($_POST["alerts"],true);
-	$success = $admin->updateUser($_POST["id"],$_POST);
-	
-	if (!$success) {
-		$_SESSION["bigtree_admin"]["update_user"] = $_POST;
-		$admin->growl("Users","Update Failed","error");
-		BigTree::redirect(ADMIN_ROOT."users/edit/".end($bigtree["path"])."/");
+	if ($_SERVER["HTTP_REFERER"] != ADMIN_ROOT."users/edit/".$_POST["id"]."/") {
+?>
+<div class="container">
+	<section>
+		<p>To update a user, please access the <a href="<?=ADMIN_ROOT?>users/edit/<?=$_POST["id"]?>/">Edit User</a> page.</p>
+	</section>
+</div>
+<?
+	} else {
+		$perms = json_decode($_POST["permissions"],true);
+		$_POST["permissions"] = array("page" => $perms["Page"],"module" => $perms["Module"],"resources" => $perms["Resource"],"module_gbp" => $perms["ModuleGBP"]);
+		$_POST["alerts"] = json_decode($_POST["alerts"],true);
+		$success = $admin->updateUser($_POST["id"],$_POST);
+		
+		if (!$success) {
+			$_SESSION["bigtree_admin"]["update_user"] = $_POST;
+			$admin->growl("Users","Update Failed","error");
+			BigTree::redirect(ADMIN_ROOT."users/edit/".end($bigtree["path"])."/");
+		}
+		
+		$admin->growl("Users","Updated User");
+		
+		BigTree::redirect(ADMIN_ROOT."users/");
 	}
-	
-	$admin->growl("Users","Updated User");
-	
-	BigTree::redirect(ADMIN_ROOT."users/");
 ?>
\ No newline at end of file

programming_language: PHP