Description
Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the ratings plugin AJAX handler, allowing attackers to forge ratings on behalf of authenticated users. Attackers can craft malicious pages that auto-submit POST requests to modify stored rating data when visited by logged-in users.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Cotonti | Cotonti | ≤ 1.0.0 | — |
References
- https://github.com/Cotonti/Cotonti/issues/1892 issue-tracking
- https://github.com/Cotonti/Cotonti/pull/1900 patch issue-tracking
- https://github.com/Cotonti/Cotonti/blob/1.0.0/plugins/ratings/ratings.ajax.php technical-description
- https://github.com/Cotonti/Cotonti product
- VulnCheck Advisory: Cotonti through 1.0.0 Cross-Site Request Forgery in the Ratings Plugin AJAX Handler third-party-advisory