Tianti Cross-Site Request Forgery Vulnerability in User Management Functions

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in Tianti CMS version 2.3. The issue resides in the user management component, specifically within the 'Add', 'Delete', 'Edit', and 'Restore' user functions'. The vulnerability allows attackers to perform arbitrary actions by sending crafted GET or POST requests, exploiting the absence of CSRF protection in the application's code.

Impact

Exploitation of this vulnerability could lead to unauthorized actions being performed on behalf of the user, such as modifying user roles or permissions.

Reproduction

To reproduce this vulnerability, log into the Tianti CMS version 2.3 and navigate to the user management interface. Click on the 'Add' button, fill in the required information, and confirm the action. Use a tool like Burp Suite to intercept the request. The captured request can be modified and sent to the server, exploiting the CSRF vulnerability. Once the request is processed, the attacker can be added as an administrator without the user's knowledge.

Remediation

To address this vulnerability, implement CSRF token verification for actions that modify user data. Additionally, consider applying same-origin policy checks to ensure that requests are coming from trusted sources.