CVE-2017-15808 (published 2017-10-23T17:29Z)

In phpMyFaq before 2.9.9, there is CSRF in admin/ajax.config.php.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-352
cwe_name: Cross-Site Request Forgery (CSRF)
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
extended_description: When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
         

Fix information:
repo_url: https://github.com/thorsten/phpMyFAQ
commit_details: repo_url: https://github.com/thorsten/phpMyFAQ
author: Thorsten Rinne
author_date: 2017-10-10 19:29:05+02:00
msg: Added missing CSRF token
repository: repo_url: https://github.com/thorsten/phpMyFAQ
repo_name: thorsten/phpMyFAQ
description: phpMyFAQ - Open Source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases
repo_language: PHP
owner: thorsten
file_changes: filename: ajax.config.php
change_type: ModificationType.MODIFY
diff: @@ -38,6 +38,11 @@ switch ($ajaxAction) {
 
     case 'add_instance':
 
+        if (!isset($_SESSION['phpmyfaq_csrf_token']) || $_SESSION['phpmyfaq_csrf_token'] !== $csrfToken) {
+            $http->sendJsonWithHeaders(array('error' => $PMF_LANG['err_NotAuth']));
+            exit(1);
+        }
+
         $url = PMF_Filter::filterInput(INPUT_GET, 'url', FILTER_SANITIZE_STRING);
         $instance = PMF_Filter::filterInput(INPUT_GET, 'instance', FILTER_SANITIZE_STRING);
         $comment = PMF_Filter::filterInput(INPUT_GET, 'comment', FILTER_SANITIZE_STRING);

programming_language: PHP
filename: instances.php
change_type: ModificationType.MODIFY
diff: @@ -97,9 +97,9 @@ if ($user->perm->checkRight($user->getUserId(), 'editinstances')) {
         <?php
         foreach ($instance->getAllInstances() as $site):
             $currentInstance = new PMF_Instance($faqConfig);
-    $currentInstance->getInstanceById($site->id);
-    $currentInstance->setId($site->id);
-    ?>
+            $currentInstance->getInstanceById($site->id);
+            $currentInstance->setId($site->id);
+            ?>
         <tr id="row-instance-<?php print $site->id ?>">
             <td><?php print $site->id ?></td>
             <td><a href="<?php print $site->url.$site->instance ?>"><?php print $site->url ?></a></td>
@@ -117,12 +117,10 @@ if ($user->perm->checkRight($user->getUserId(), 'editinstances')) {
                    data-csrf-token="<?php echo $user->getCsrfTokenFromSession() ?>">
                     <i aria-hidden="true" class="fa fa-trash"></i>
                 </a>
-                <?php endif;
-    ?>
+                <?php endif; ?>
             </td>
         </tr>
-        <?php endforeach;
-    ?>
+        <?php endforeach; ?>
         </tbody>
     </table>
 
@@ -135,6 +133,7 @@ if ($user->perm->checkRight($user->getUserId(), 'editinstances')) {
                 </div>
                 <div class="modal-body">
                     <form class="form-horizontal" action="#" method="post" accept-charset="utf-8">
+                        <input type="hidden" name="csrf" id="csrf" value="<?php echo $user->getCsrfTokenFromSession() ?>">
                         <div class="form-group">
                             <label class="control-label col-lg-4">
                                 <?php echo $PMF_LANG['ad_instance_url'] ?>:
@@ -205,6 +204,7 @@ if ($user->perm->checkRight($user->getUserId(), 'editinstances')) {
             // Add instance
             $('.pmf-instance-add').click(function(event) {
                 event.preventDefault();
+                var csrf     = $('#csrf').val();
                 var url      = $('#url').val();
                 var instance = $('#instance').val();
                 var comment  = $('#comment').val();
@@ -213,8 +213,9 @@ if ($user->perm->checkRight($user->getUserId(), 'editinstances')) {
                 var password = $('#password').val();
 
                 $.get('index.php',
-                    { action: 'ajax', ajax: 'config', ajaxaction: 'add_instance',
-                        url: url, instance: instance, comment: comment, email: email, admin: admin, password: password
+                    {
+                        action: 'ajax', ajax: 'config', ajaxaction: 'add_instance', csrf: csrf, url: url,
+                        instance: instance, comment: comment, email: email, admin: admin, password: password
                     },
                     function(data) {
                         if (typeof(data.added) === 'undefined') {

programming_language: PHP