CWE-352

{
  "affected": [],
  "aliases": [
    "CVE-2014-7281"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2014-10-23T14:55:00Z",
    "severity": "MODERATE"
  },
  "details": "Cross-site request forgery (CSRF) vulnerability in Shenzhen Tenda Technology Tenda A32 Router with firmware 5.07.53_CN allows remote attackers to hijack the authentication of administrators for requests that reboot the device via a request to goform/SysToolReboot.",
  "id": "GHSA-jvq9-jp5q-hg2j",
  "modified": "2022-05-17T04:30:26Z",
  "published": "2022-05-17T04:30:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-7281"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/show/osvdb/113308"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/128671/Tenda-A32-Cross-Site-Request-Forgery.html"
    },
    {
      "type": "WEB",
      "url": "http://www.exploit-db.com/exploits/34969"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2015-5534"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2015-11-02T19:59:00Z",
    "severity": "MODERATE"
  },
  "details": "Multiple cross-site request forgery (CSRF) vulnerabilities in Oxwall before 1.8 allow remote attackers to hijack the authentication of administrators for requests that (1) put the website under maintenance via the maintenance_enable parameter or (2) conduct cross-site scripting (XSS) attacks via the maintenance_text parameter to admin/pages/maintenance.",
  "id": "GHSA-jvw3-45p9-fr63",
  "modified": "2025-04-12T12:53:40Z",
  "published": "2022-05-14T02:48:01Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5534"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/38581"
    },
    {
      "type": "WEB",
      "url": "https://www.htbridge.com/advisory/HTB23266"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/134124/Oxwall-1.7.4-Cross-Site-Request-Forgery.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/536784/100/0/threaded"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "phpmyadmin/phpmyadmin"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.6.0"
            },
            {
              "fixed": "4.6.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "phpmyadmin/phpmyadmin"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.4.0"
            },
            {
              "fixed": "4.4.15.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "phpmyadmin/phpmyadmin"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.0.10.18"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2016-9866"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-07-31T21:44:50Z",
    "nvd_published_at": "2016-12-11T03:00:00Z",
    "severity": "CRITICAL"
  },
  "details": "An issue was discovered in phpMyAdmin. When the arg_separator is different from its default \u0026 value, the CSRF token was not properly stripped from the return URL of the preference import action. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.",
  "id": "GHSA-jvxx-8xxf-5495",
  "modified": "2023-11-02T20:49:24Z",
  "published": "2022-05-17T02:36:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9866"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/phpmyadmin/composer"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/201701-32"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20210123194736/http://www.securityfocus.com/bid/94536"
    },
    {
      "type": "WEB",
      "url": "https://www.phpmyadmin.net/security/PMASA-2016-71"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "phpMyAdmin CSRF Vulnerability"
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-9434"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-10-31T07:15:03Z",
    "severity": "MODERATE"
  },
  "details": "The WPGlobus Translate Options plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.0. This is due to missing or incorrect nonce validation on the on__translate_options_page() function. This makes it possible for unauthenticated attackers to inject malicious web scripts and update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.",
  "id": "GHSA-jw3m-xrj9-f6q7",
  "modified": "2024-10-31T09:30:42Z",
  "published": "2024-10-31T09:30:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9434"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/wpglobus-translate-options/trunk/includes/class-wpglobus-translate-options.php#L442"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ddca65fa-0744-4b2a-808c-a913586edc60?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-1830"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-06-20T11:15:00Z",
    "severity": "MODERATE"
  },
  "details": "The Amazon Einzeltitellinks WordPress plugin through 1.3.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping",
  "id": "GHSA-jw56-69rq-622c",
  "modified": "2022-06-29T00:00:28Z",
  "published": "2022-06-21T00:00:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1830"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/a6b3e927-41e2-4e48-b9e1-8c58a1b9a933"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-36891"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-06-15T20:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Cross-Site Request Forgery (CSRF) vulnerability in Photo Gallery by Supsystic plugin \u003c= 1.15.5 at WordPress allows changing the plugin settings.",
  "id": "GHSA-jw5f-6r3j-fc5c",
  "modified": "2022-06-25T00:01:02Z",
  "published": "2022-06-16T00:00:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-36891"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/gallery-by-supsystic/wordpress-photo-gallery-by-supsystic-plugin-1-15-5-cross-site-request-forgery-csrf-leading-to-plugin-settings-change"
    },
    {
      "type": "WEB",
      "url": "https://wordpress.org/plugins/gallery-by-supsystic/#developers"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "wwbn/avideo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "29.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-43877"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-05T19:13:03Z",
    "nvd_published_at": "2026-05-11T22:22:12Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\n`objects/userSavePhoto.php` is a legacy profile-photo endpoint that accepts a base64 POST parameter and writes the decoded bytes to `videos/userPhoto/photo\u003cusers_id\u003e.png`. Its only access control is `User::isLogged()`. It does not end in `.json.php`, so it is excluded from the project\u0027s global `autoCSRFGuard` (which is suffix-scoped in `objects/include_config.php`). There is no CSRF token, no Origin/Referer check, and no MIME validation of the decoded bytes. Because AVideo\u0027s default cookie policy is `SameSite=None; Secure` on HTTPS (`objects/functionsPHP.php:227`), an attacker who lures a logged-in user to a malicious page can overwrite that user\u0027s profile photo with arbitrary bytes and also triggers a site-wide `clearCache(true)` on every forged request.\n\n## Details\n\nHandler (`objects/userSavePhoto.php`, 51 lines total):\n\n```php\n// line 12 - only access control\nif (!User::isLogged()) {\n    $obj-\u003emsg = __(\"You must be logged\");\n    die(json_encode($obj));\n}\n// ...\n// line 29 - unvalidated base64 from POST\n$fileData = base64DataToImage($_POST[\u0027imgBase64\u0027]);\n// line 30 - deterministic filename tied to the VICTIM\u0027s session\n$fileName = \u0027photo\u0027. User::getId().\u0027.png\u0027;\n$photoURL = $imagePath.$fileName;\n// line 35 - raw bytes written to disk\n$bytes = file_put_contents($global[\u0027systemRootPath\u0027].$photoURL, $fileData);\n// lines 43-48 - DB update + global cache invalidation unconditionally\n$user = new User(User::getId());\n$user-\u003esetPhotoURL($photoURL);\nif ($user-\u003esave()) {\n    User::deleteOGImage(User::getId());\n    User::updateSessionInfo();\n    clearCache(true);\n}\n```\n\n`base64DataToImage` (`objects/functionsImages.php:1026`) performs no content validation:\n\n```php\nfunction base64DataToImage($imgBase64) {\n    $img = $imgBase64;\n    $img = str_replace(\u0027data:image/png;base64,\u0027, \u0027\u0027, $img);\n    $img = str_replace(\u0027 \u0027, \u0027+\u0027, $img);\n    return base64_decode($img);\n}\n```\n\nThere is no call to `getimagesizefromstring`, `imagecreatefromstring`, or MIME detection. Arbitrary bytes up to `post_max_size` are accepted.\n\n**Why the global CSRF guard does not apply.** `objects/include_config.php` (around line 314) only invokes `autoCSRFGuard` when the script filename matches `*.json.php`:\n\n```php\nif (... $_SERVER[\u0027REQUEST_METHOD\u0027] === \u0027POST\u0027 \u0026\u0026\n    substr($baseName, -9) === \u0027.json.php\u0027) {\n    autoCSRFGuard($baseName, $_SERVER[\u0027SCRIPT_FILENAME\u0027]);\n}\n```\n\n`userSavePhoto.php` is missing the `.json.php` suffix, so neither `autoCSRFGuard` nor `forbidIfIsUntrustedRequest` runs. There is no explicit call to any of these in the file (verified by grep: no `getCSRF`, no `forbidIfIsUntrustedRequest`, no `HTTP_ORIGIN`, no `HTTP_REFERER`). Routing rewrites in `.htaccess` also expose this handler as `/savePhoto`.\n\n**Why the victim\u0027s cookie is sent cross-origin.** `objects/functionsPHP.php:227`:\n\n```php\nfunction _getCookieSameSiteValue($secure) {\n    return $secure ? \u0027None\u0027 : \u0027Lax\u0027;\n}\n```\n\nOn HTTPS (the expected deployment), session cookies default to `SameSite=None; Secure`, which browsers attach to cross-site POSTs. A plain `application/x-www-form-urlencoded` form POST is a \"simple request\" under CORS rules and does not trigger a preflight, so the browser sends the POST and its cookie without the server having to opt in.\n\n## PoC\n\n1. Victim logs into the AVideo instance (e.g., `https://victim.example.com`). `PHPSESSID` is set with `SameSite=None; Secure`.\n2. Attacker hosts the following HTML on any domain:\n\n```html\n\u003c!doctype html\u003e\n\u003chtml\u003e\u003cbody\u003e\n\u003cform id=\"f\" action=\"https://victim.example.com/objects/userSavePhoto.php\" method=\"POST\"\u003e\n  \u003c!-- Any bytes: here, \u0027HELLO WORLD\u0027 base64-encoded --\u003e\n  \u003cinput name=\"imgBase64\" value=\"SEVMTE8gV09STEQ=\"\u003e\n\u003c/form\u003e\n\u003cscript\u003edocument.forms[0].submit();\u003c/script\u003e\n\u003c/body\u003e\u003c/html\u003e\n```\n\n3. Victim visits the attacker page in the same browser. The form auto-submits. The browser sends the POST with the victim\u0027s session cookie.\n4. `userSavePhoto.php` passes the `User::isLogged()` check, decodes the base64, and writes the raw bytes to `videos/userPhoto/photo\u003cVICTIM_USERS_ID\u003e.png`. It also calls `$user-\u003esave()`, `User::deleteOGImage()`, `User::updateSessionInfo()`, and `clearCache(true)`.\n5. Fetching `https://victim.example.com/videos/userPhoto/photo\u003cVICTIM_USERS_ID\u003e.png` (the file is now the attacker\u0027s bytes \u2014 `HELLO WORLD` in this test case). The response is `200 OK` and the body equals the submitted bytes.\n\nReplace the `imgBase64` payload with a valid PNG to make the defacement visually persuasive, or with up to ~6 MB of any bytes to force a large write.\n\n## Impact\n\n- **Integrity \u2014 profile defacement of any logged-in user.** One click lets an attacker replace a victim\u0027s profile photo with arbitrary bytes: offensive imagery, misleading branding, or a clone of another user\u0027s photo for impersonation. The file path is deterministic (`photo\u003cusers_id\u003e.png`), so the attacker can later direct others to the overwritten URL.\n- **Availability \u2014 global cache thrash.** Every successful forged request calls `clearCache(true)`, invalidating application-wide caches. Repeatedly tricking logged-in users into visiting the attacker page (e.g., by including the payload as a hidden iframe on a popular site) produces sustained cache invalidation.\n- **Availability \u2014 disk pressure.** With no size cap beyond PHP\u0027s `post_max_size` (default 8 MB \u2192 ~6 MB after base64 decode), each forged submission writes a multi-megabyte file. Across many victims this enables distributed disk exhaustion.\n- **No confidentiality impact** and no code execution (files are served with `Content-Type: image/png` based on extension, so SVG-with-script payloads are not interpreted).\n- **Related endpoints.** `objects/userSaveBackground.php` exhibits the same pattern (same `base64DataToImage` sink, same lack of CSRF/Origin/MIME checks) and is exploitable identically; fix should be applied consistently.\n\n## Recommended Fix\n\nApply the existing same-origin guard that protects the `*.json.php` endpoints and add content validation. In `objects/userSavePhoto.php`, immediately after the login check:\n\n```php\nrequire_once $global[\u0027systemRootPath\u0027] . \u0027objects/functionsSecurity.php\u0027;\nforbidIfIsUntrustedRequest(\u0027userSavePhoto\u0027);\n\n$raw = $_POST[\u0027imgBase64\u0027] ?? \u0027\u0027;\nif (strlen($raw) \u003e 2 * 1024 * 1024) { // ~1.5 MB decoded cap\n    $obj-\u003emsg = __(\u0027Image too large\u0027);\n    die(json_encode($obj));\n}\n$fileData = base64DataToImage($raw);\nif ($fileData === false || $fileData === \u0027\u0027 || @imagecreatefromstring($fileData) === false) {\n    $obj-\u003emsg = __(\u0027Invalid image\u0027);\n    die(json_encode($obj));\n}\n```\n\nThe longer-term fix is to broaden the global guard in `objects/include_config.php` so that `autoCSRFGuard` covers every authenticated POST handler, not only those whose filenames end in `.json.php` \u2014 the current suffix-based gating is a footgun that silently excludes legacy endpoints like `userSavePhoto.php` and `userSaveBackground.php`. Also consider moving the `clearCache(true)` call inside the `if ($bytes)` branch so that zero-byte writes do not invalidate the global cache.",
  "id": "GHSA-jw8g-5j46-44rp",
  "modified": "2026-05-13T14:19:40Z",
  "published": "2026-05-05T19:13:03Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-jw8g-5j46-44rp"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43877"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/commit/9c38468041505e637101c5943c5370c68f48e3ac"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/WWBN/AVideo"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "AVideo: CSRF in userSavePhoto.php Allows Cross-Origin Overwrite of Authenticated Users\u0027 Profile Photos with Arbitrary Content"
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-23554"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-18T00:15:07Z",
    "severity": "MODERATE"
  },
  "details": "Cross-Site Request Forgery (CSRF) on Session Token vulnerability that could potentially lead to Remote Code Execution (RCE).",
  "id": "GHSA-jw9q-cpgg-x45m",
  "modified": "2026-01-08T21:30:28Z",
  "published": "2024-05-18T00:30:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23554"
    },
    {
      "type": "WEB",
      "url": "https://support.hcltechsw.com/csm?id=kb_article\u0026sysparm_article=KB0113140"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-54673"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-08-14T11:15:45Z",
    "severity": "MODERATE"
  },
  "details": "Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Chartify allows Cross Site Request Forgery. This issue affects Chartify: from n/a through 3.5.3.",
  "id": "GHSA-jw9q-qh9j-xhxp",
  "modified": "2026-04-01T18:35:50Z",
  "published": "2025-08-14T12:30:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54673"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/chart-builder/vulnerability/wordpress-chartify-plugin-plugin-3-5-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-24984"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-03-11T22:15:00Z",
    "severity": "HIGH"
  },
  "details": "An issue was discovered in Quadbase EspressReports ES 7 Update 9. It allows CSRF, whereby an attacker may be able to trick an authenticated admin level user into uploading malicious files to the web server.",
  "id": "GHSA-jwc9-vppx-v4hj",
  "modified": "2022-05-24T17:44:15Z",
  "published": "2022-05-24T17:44:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-24984"
    },
    {
      "type": "WEB",
      "url": "https://c41nc.co.uk/cve-2020-24984"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}