CWE-352

{
  "affected": [],
  "aliases": [
    "CVE-2013-0144"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2013-06-07T20:55:00Z",
    "severity": "MODERATE"
  },
  "details": "Cross-site request forgery (CSRF) vulnerability in cgi-bin/create_user.cgi on QNAP VioStor NVR devices with firmware 4.0.3 allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts via a NEW USER action.",
  "id": "GHSA-932p-42hx-9c5w",
  "modified": "2022-05-05T02:48:29Z",
  "published": "2022-05-05T02:48:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0144"
    },
    {
      "type": "WEB",
      "url": "http://www.kb.cert.org/vuls/id/927644"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-32320"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-07-17T17:15:00Z",
    "severity": "HIGH"
  },
  "details": "A Cross-Site Request Forgery (CSRF) in Ferdi through 5.8.1 and Ferdium through 6.0.0-nightly.98 allows attackers to read files via an uploaded file such as a settings/preferences file.",
  "id": "GHSA-933j-3hjh-372c",
  "modified": "2022-07-26T00:00:30Z",
  "published": "2022-07-18T00:00:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-32320"
    },
    {
      "type": "WEB",
      "url": "https://getferdi.com"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/omriinbar-cyesec/c1179fe99725d2b828b6573c0d110c9c"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getferdi/ferdi"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-25152"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-07T10:15:20Z",
    "severity": "HIGH"
  },
  "details": "Cross-Site Request Forgery (CSRF) vulnerability in LukaszWiecek Smart DoFollow allows Stored XSS. This issue affects Smart DoFollow: from n/a through 1.0.2.",
  "id": "GHSA-933j-4722-7q8q",
  "modified": "2026-04-01T18:33:35Z",
  "published": "2025-02-07T12:31:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25152"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/smart-dofollow/vulnerability/wordpress-smart-dofollow-plugin-1-0-2-csrf-to-stored-xss-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.jenkins-ci.plugins:security-inspector"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "17.v6eecc36919c2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-41236"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-12-06T16:03:37Z",
    "nvd_published_at": "2022-09-21T16:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Security Inspector Plugin 117.v6eecc36919c2 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability. This vulnerability allows attackers to replace the generated report stored in a per-session cache and displayed to authorized users at the `\u2026\u200b/report` URL with a report based on attacker-specified report generation options. This could create confusion in users of the plugin who are expecting to see a different result. A security hardening since Jenkins 2.287 and LTS 2.277.2 prevents exploitation of this vulnerability for the _Single user, multiple jobs_ report however, there is no fix at this time. Other report types are still affected.",
  "id": "GHSA-933x-5g7r-773q",
  "modified": "2022-12-06T16:03:37Z",
  "published": "2022-09-22T00:00:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41236"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jenkinsci/security-inspector-plugin"
    },
    {
      "type": "WEB",
      "url": "https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2051"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "CSRF vulnerability in Jenkins Security Inspector plugin"
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-20322"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-07T18:15:26Z",
    "severity": "MODERATE"
  },
  "details": "In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.104, 9.3.2408.113, and 9.2.2406.119, an unauthenticated attacker could send a specially-crafted SPL search command that could trigger a rolling restart in the Search Head Cluster through a Cross-Site Request Forgery (CSRF), potentially leading to a denial of service (DoS).\u003cbr\u003e\u003cbr\u003eThe vulnerability requires the attacker to phish the administrator-level victim by tricking them into initiating a request within their browser. The attacker should not be able to exploit the vulnerability at will.\u003cbr\u003e\u003cbr\u003eSee [How rolling restart works](https://docs.splunk.com/Documentation/Splunk/9.4.2/DistSearch/RestartSHC) for more information.",
  "id": "GHSA-934h-hvxg-j69v",
  "modified": "2025-07-07T18:32:28Z",
  "published": "2025-07-07T18:32:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-20322"
    },
    {
      "type": "WEB",
      "url": "https://advisory.splunk.com/advisories/SVD-2025-0705"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2014-9334"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2014-12-24T18:59:00Z",
    "severity": "MODERATE"
  },
  "details": "Multiple cross-site request forgery (CSRF) vulnerabilities in the Bird Feeder plugin 1.2.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) user or (2) password parameter in the bird-feeder page to wp-admin/options-general.php.",
  "id": "GHSA-9356-6c72-33x9",
  "modified": "2022-05-17T01:12:05Z",
  "published": "2022-05-17T01:12:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-9334"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/99474"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/129623/WordPress-Bird-Feeder-1.2.3-CSRF-XSS.html"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2014/Dec/69"
    },
    {
      "type": "WEB",
      "url": "http://www.vulnerability-lab.com/get_content.php?id=1372"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2017-8082"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-04-24T06:59:00Z",
    "severity": "MODERATE"
  },
  "details": "concrete5 8.1.0 has CSRF in Thumbnail Editor in the File Manager, which allows remote attackers to disable the entire installation by merely tricking an admin into viewing a malicious page involving the /tools/required/files/importers/imageeditor?fID=1\u0026imgData= URI. This results in a site-wide denial of service making the site not accessible to any users or any administrators.",
  "id": "GHSA-935f-hm9p-8j6v",
  "modified": "2022-05-13T01:08:38Z",
  "published": "2022-05-13T01:08:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-8082"
    },
    {
      "type": "WEB",
      "url": "https://drive.google.com/open?id=0B3vXUYdNMECWZTd3SFRnUjllWk0"
    },
    {
      "type": "WEB",
      "url": "https://twitter.com/insecurity/status/856066923146215425"
    },
    {
      "type": "WEB",
      "url": "http://zeroday.insecurity.zone/exploits/concrete5_csrf_dos.txt"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "yeswiki/yeswiki"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.6.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-52777"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352",
      "CWE-502"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-09T21:02:58Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "## Details\n\n### Sink\n\n`tools/bazar/services/CSVManager.php` line 372-399:\n\n```\npublic function importEntry(array $importedEntries, string $formId): ?array\n{\n    if (!$this-\u003eimportdone) {\n        // ...\n        foreach ($importedEntries as $entry) {\n            $entry = unserialize(base64_decode($entry));   // \u003c-- SINK\n            $entry = array_map(\u0027strval\u0027, $entry);\n            // ...\n```\n\nThere is no `[\u0027allowed_classes\u0027 =\u003e false]` argument; arbitrary classes are instantiated. The subsequent `array_map(\u0027strval\u0027, $entry)` additionally exercises `__toString` on each top-level array element, doubling the magic-method surface available to a gadget chain.\n\n### Source\n\n`tools/bazar/actions/BazarImportAction.php`:\n\n```\n// formatArguments()\n\u0027mode\u0027 =\u003e (isset($_POST[\u0027submit_file\u0027]) \u0026\u0026 !empty($_FILES[\u0027fileimport\u0027][\u0027name\u0027])) ? \u0027submitfile\u0027 :\n    (isset($_POST[\u0027importfiche\u0027]) ? \u0027importentries\u0027 : \u0027default\u0027),\n\u0027importentries\u0027 =\u003e $_POST[\u0027importfiche\u0027] ?? null,\n\n// run()\ncase \u0027importentries\u0027:\n    // ...\n    $importedEntries = $this-\u003eCSVManager-\u003eimportEntry($this-\u003earguments[\u0027importentries\u0027], $vID[\u0027id\u0027]);\n    break;\n```\n\n`$_POST[\u0027importfiche\u0027]` flows directly to the sink. The `mode` switches to `\u0027importentries\u0027` whenever the request body contains the key, so an attacker need only POST `importfiche[0]=\u003cpayload\u003e`.\n\n### Reachability\n\n1. The action is registered as `bazarimport`. The default `BazaR` page (`setup/sql/default-content.sql` -\u003e `BazaR` page entry, ships with `{{bazar showexportbuttons=\"1\"}}`) routes `?BazaR\u0026vue=importer\u0026id_typeannonce=\u003cN\u003e` to `BazarAction::run()` -\u003e `case VOIR_IMPORTER -\u003e callAction(\u0027bazarimport\u0027, ...)` (`tools/bazar/actions/BazarAction.php:257-258`). So the sink is reachable on a default install with no extra page authoring.\n\n2. `BazarImportAction::run()` calls `$this-\u003echeckSecuredACL()` with the default `$adminOnly=true`. Only wiki admins (or accounts the admin has added to the `bazarimport` action ACL) can execute it.\n\n3. The `importentries` branch does NOT invoke `CsrfTokenController::checkToken(...)`. Grepping `tools/bazar/actions/BazarImportAction.php` confirms the action class has no `csrf` or `checkToken` reference at all. This is asymmetric with sibling actions: `tools/bazar/controllers/FormController.php` does call `checkToken(\u0027main\u0027, \u0027POST\u0027, \u0027confirmDeleteToken\u0027)` for destructive operations. The import path skips the same protection.\n\n4. Therefore the full kill chain for a remote attacker is:\n\n   a. Identify any admin user on the target wiki.\n   b. Deliver an HTML page (email, chat, link) that auto-POSTs `importfiche[0]=\u003cbase64-encoded PHPGGC payload\u003e` to `https://\u003cwiki\u003e/?BazaR\u0026vue=importer\u0026id_typeannonce=1`.\n   c. The admin\u0027s session cookie is sent automatically; the action passes `checkSecuredACL`; the unserialize fires.\n\n### Gadget chain availability\n\n`composer.json` requires `doctrine/annotations ^1.11` and `doctrine/cache ^1.10`. Both have published PHPGGC chains (`Doctrine/RCE1`, `Doctrine/FW1`, `Doctrine/FW2`, etc., from https://github.com/ambionics/phpggc). These chains terminate in either `system($cmd)` (RCE1) or `file_put_contents($php_file, $contents)` (FW1) entry-points -- both sufficient to give the attacker shell on the YesWiki host.\n\nThis advisory does not include a working PHPGGC chain end-to-end (writing a chain that survives YesWiki\u0027s exact dependency-resolved class graph is separate work). The PoC demonstrates the primitive (attacker-controlled class instantiation + magic-method execution); the chain is a downstream exercise using public tooling.\n\n### Past advisories cross-check\n\nYesWiki\u0027s published GitHub advisories cover XSS, SQLi, arbitrary-PHP-file-write RCE, path traversal, and unauthenticated backup download. None covers an `unserialize` / PHP-object-injection sink, so this is a novel vulnerability class for the project.\n\n## PoC\n\nA self-contained PoC reproducing the inner loop is available; it copies the exact two-line sink and proves that attacker-controlled `__destruct` runs without booting the full application.\n\nRun:\n\n```\nphp poc.php\n```\n\nOutput (verbatim):\n\n```\nCrafted importfiche[0] payload (form-ready, urlencoded):\nYToxOntpOjA7Tzo2OiJHYWRnZXQiOjE6e3M6NjoibWFya2VyIjtzOjIyOiJQV05FRC1GUk9NLVVOU0VSSUFMSVpFIjt9fQ%3D%3D\n\n== before importEntry ==\n[Gadget] __destruct fired with marker=\u0027PWNED-FROM-UNSERIALIZE\u0027\nPHP Fatal error:  Uncaught Error: Object of class Gadget could not be converted to string ...\n[Gadget] __destruct fired with marker=\u0027PWNED-FROM-UNSERIALIZE\u0027\n```\n\nThe two `[Gadget] __destruct fired` lines (one from inside the loop, one from the engine shutdown after the TypeError) confirm that the attacker-defined `Gadget::__destruct` executed -- with the attacker-supplied marker -- inside the unmodified `importEntry` code path.\n\nEnd-to-end against a live YesWiki install:\n\n```\ncurl -i -b \"yeswiki_session=\u003cadmin_cookie\u003e\" \\\n     -X POST \"https://wiki.example.com/?BazaR\u0026vue=importer\u0026id_typeannonce=1\" \\\n     --data-urlencode \\\n     \"importfiche[0]=YToxOntpOjA7Tzo2OiJHYWRnZXQiOjE6e3M6NjoibWFya2VyIjtzOjIyOiJQV05FRC1GUk9NLVVOU0VSSUFMSVpFIjt9fQ==\"\n```\n\n(replace the payload with a real PHPGGC `Doctrine/FW1` or `Doctrine/RCE1` output to obtain RCE on the target host).\n\n## Impact\n\n- Authenticated wiki admin who lands on attacker-controlled HTML obtains remote code execution on the YesWiki server (via the cross-site forgery path; no admin interaction with the import UI is required).\n- An attacker who has already compromised an admin password upgrades from \"wiki content management\" to \"OS shell on the hosting box\".\n- The compromise survives the wiki layer entirely: the attacker can write web shells, exfiltrate other sites on shared hosting, modify `wakka.config.php`, dump the MySQL database, and pivot from there.\n\n## Suggested fix\n\n1. `tools/bazar/services/CSVManager.php::importEntry` -- pass `[\u0027allowed_classes\u0027 =\u003e false]` to `unserialize`, or, better, replace the base64+serialize transport with the JSON transport the current UI already uses (`?api/entries/{formId}` POST in `tools/bazar/presentation/javascripts/bazar-import.js`). The serialized-PHP transport appears to be an unused legacy path.\n2. `tools/bazar/actions/BazarImportAction.php` -- add a `CsrfTokenController::checkToken(\u0027main\u0027, \u0027POST\u0027, \u0027csrf-token\u0027, false)` guard for the `\u0027importentries\u0027` mode (and any other state-changing modes). The existing `tools/bazar/controllers/FormController.php` pattern can be lifted directly.",
  "id": "GHSA-9369-69wj-7m2f",
  "modified": "2026-07-09T21:02:58Z",
  "published": "2026-07-09T21:02:58Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/YesWiki/yeswiki/security/advisories/GHSA-9369-69wj-7m2f"
    },
    {
      "type": "WEB",
      "url": "https://github.com/YesWiki/yeswiki/commit/8f70a8d6b8befa0e644d03c785701dbbc55b8fd0"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/YesWiki/yeswiki"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
      "type": "CVSS_V4"
    }
  ],
  "summary": "YesWiki Vulnerable to Authenticated PHP Object Injection in BazarImportAction via unserialize"
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-21139"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-11-04T20:15:00Z",
    "severity": "MODERATE"
  },
  "details": "EC Cloud E-Commerce System v1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily add admin accounts via /admin.html?do=user\u0026act=add.",
  "id": "GHSA-937r-w77w-qxwp",
  "modified": "2022-05-24T19:19:43Z",
  "published": "2022-05-24T19:19:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-21139"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Ryan0lb/EC-cloud-e-commerce-system-CVE-application/blob/master/README.md"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-36514"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-07-17T15:15:09Z",
    "severity": "HIGH"
  },
  "details": "Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce Shipping Multiple Addresses plugin \u003c=\u00a03.8.5 versions.",
  "id": "GHSA-938w-g36g-q56g",
  "modified": "2024-04-04T06:10:29Z",
  "published": "2023-07-17T15:30:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36514"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/woocommerce-shipping-multiple-addresses/wordpress-woocommerce-ship-to-multiple-addresses-plugin-3-8-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}