Cross-Site Request Forgery in iWebShop Password Change Function

Executive Summary

This vulnerability is a Cross-Site Request Forgery (CSRF) flaw in the aircheng-org iWebShop-5 software up to version 5.16. It exists in the password change function of the admin panel. An attacker can trick an administrator into changing their password by exploiting the lack of CSRF tokens in password update forms, leading to unauthorized account takeover.

Useful 0 Not Useful 0

Detection Guidance

To detect this CSRF vulnerability in iWebShop-5, inspect the admin_repwd and admin_repwd_act endpoints in controllers/system.php for missing CSRF tokens in POST forms. Check if password change requests rely solely on cookie authentication without additional protections.

Useful 0 Not Useful 0

Impact Analysis

An attacker could force an administrator to change their password without their knowledge by tricking them into visiting a malicious website. This would allow the attacker to take over the admin account, gaining full control over the iWebShop-5 application and potentially accessing sensitive data or performing unauthorized actions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access control. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage due to potential data breaches.

Useful 0 Not Useful 0

Mitigation Strategies

Implement per-session CSRF tokens for state-changing endpoints like password changes. Validate Origin/Referer headers for sensitive requests. Use SameSite=strict for session cookies to prevent CSRF attacks.

Useful 0 Not Useful 0