Cross-Site Request Forgery (CSRF) in livehelperchat/livehelperchat

Valid

Reported on

Dec 16th 2021

Description

I found one more CSRF at Clean cache in the System tab of System configuration via GET request.

<a href="https://demo.livehelperchat.com/site_admin/system/expirecache">CLICK ME!</a>

This vulnerability is capable of tricking admin to clear the cache of the system, that can potential lead to a DoS attack.

Use POST request combined with a CSRF token instead of using GET request.

expirecache.tpl.php L1-L3

We are processing your report and will contact the livehelperchat team within 24 hours. 2 years ago

Remigijus Kiminas validated this vulnerability 2 years ago

KhanhCM has been awarded the disclosure bounty

The fix bounty is now up for grabs

Remigijus Kiminas marked this as fixed in 2.0 with commit 3b5d0a 2 years ago

The fix bounty has been dropped

This vulnerability will not receive a CVE

to join this conversation