Administrative settings modification via missing CSRF validation
Published Feb 26, 2024 · Updated Aug 2, 2024
Cross-site request forgery in ITFlow before commit 432488eca3998c5be6b6b9e8f8ba01f54bc12378 allows remote attackers to modify admin settings. The post/setting.php handlers accepted state-changing POST fields under an authenticated session without validating a CSRF token, while the corresponding forms omitted that token. An authenticated administrator must visit attacker-controlled content; successful requests can change company, mail, invoice, integration, security, and payment settings.
Summary
What happened
Cross-site request forgery in ITFlow before commit 432488eca3998c5be6b6b9e8f8ba01f54bc12378 allows remote attackers to modify admin settings. The post/setting.php handlers accepted state-changing POST fields under an authenticated session without validating a CSRF token, while the corresponding forms omitted that token. An authenticated administrator must visit attacker-controlled content; successful requests can change company, mail, invoice, integration, security, and payment settings.
The record
- CVE
- CVE-2024-25344
- Published
- Feb 26, 2024
- Updated
- Aug 2, 2024
- Vendor
- ITFlow
- Product
- ITFlow
- Classifications
- CWE-79
- Attack vector
- network
- Privileges
- unauthenticated
Timeline
How it unfolded
- Feb 26, 2024CVE publishedPublication date reported by the CVE source.
- Aug 2, 2024Record updatedLatest update available in the CVE record.
Exploitability
Present is not the same as exploitable
Compare your product and version with the public record. A matching version still requires validation against your environment.
Is a vulnerable build present?
Compare these published version ranges with your installed build and any vendor patches.
- Affected versionversion=0 <432488eca3998c5be6b6b9e8f8ba01f54bc12378
What conditions does exploitation require?
What is affected?
Published CVSS scores
CVSS describes severity. EPSS estimates exploitation probability.
Attacks
What attackers are doing with it
Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.
Weakness, pattern, technique
Public exploit references
- ITFlow Cross Site Request Forgeryproof of concept · unverified
Labels summarize the accepted research assessment. They do not indicate a test against your environment.
Technologies
Your stack
See the directory against your own environment.
Your stack
Check the software in your environment
Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.
Book a demo