e107 2.0 Alpha2 Cross Site Request Forgery

`Advisory: CSRF vulnerability in CMS e107 v.2 alpha2  
Advisory ID: SROEADV-2014-04  
Author: Steffen Rösemann  
Affected Software: CMS e107 v.2 alpha2 (Release-Date: 08th-Jun-2014)  
Vendor URL: http://e107.org  
Vendor Status: solved  
CVE-ID: -  
  
==========================  
Vulnerability Description:  
==========================  
  
The Content Management System e107 v.2 alpha2 allows an attacker to become  
an administrative user (without rights) when tricking the admin into  
executing a CSRF-vulnerable URL including the attackers user-id.  
  
==================  
Technical Details:  
==================  
  
The administrative backend of e107 v.2 alpha2 provides the functionality to  
put a user instant in the administrators group by using the following url  
when the administrator is already logged in:  
  
http://{DOMAIN/HOSTNAME}/e107_admin/users.php?mode=main&action=admin&id={ID}  
  
An attacker could try to abuse this in convincing the admin to execute a  
link which contains the id of the attackers user-account or trick him to go  
on a page the attacker controls where this URL is opened (e.g. in a hidden  
iframe) while the admin is logged in.  
  
The attacker knows his own id because it is shown on his user profile:  
  
http://{DOMAIN/HOSTNAME}/user.php?id.{ID}  
  
Although the attacker would not instant gain any rights it is a security  
issue.  
  
Combined with clickjacking and/or other social engineering attacks this  
issue could be expanded to gain such elevated rights.  
  
=========  
Solution:  
=========  
  
Install the latest patch from the github repository (see below).  
  
  
====================  
Disclosure Timeline:  
====================  
22-Dec-2014 – found the vulnerability  
22-Dec-2014 - informed the developers  
26-Dec-2014 – release date of this security advisory [without technical  
details]  
27-Dec-2014 – vendor responded and provided a patch  
28-Dec-2014 – release date of this security advisory  
28-Dec-2014 – post on Bugtraq / FullDisclosure  
  
========  
Credits:  
========  
  
Vulnerability found and advisory written by Steffen Rösemann.  
  
===========  
References:  
===========  
  
http://e107.org  
https://github.com/e107inc/e107/commit/9249f892b1e635979db2a830393694fb73531080  
http://sroesemann.blogspot.de  
  
  
`