-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| alextselegidis/easyappointments | composer | <= 1.5.2 |
Miggo AIRoot Cause AnalysisThe vulnerability exists because the core CSRF protection mechanism in EA_Security::csrf_verify is only applied to POST requests. This means any sensitive, state-changing action that accepts parameters via a GET request is vulnerable to a CSRF attack. An attacker can trick a logged-in administrator into visiting a malicious webpage, which then makes a GET request to the vulnerable application endpoint, performing actions on the attacker's behalf.
The provided patch addresses this by implementing a 'controller hardening' strategy. It introduces a new helper function, method(), which strictly enforces the expected HTTP method (e.g., 'POST') for controller actions that modify data. This change is applied across numerous controllers, including those for managing admins, appointments, customers, and system settings. By ensuring these actions only respond to POST requests, the application forces them through the existing CSRF protection, effectively mitigating the vulnerability. The functions listed were all patched to enforce the POST method, indicating they were previously vulnerable to this CSRF bypass.
EA_Security.csrf_verifyapplication/core/EA_Security.php
Admins.storeapplication/controllers/Admins.php
Admins.updateapplication/controllers/Admins.php
Account.saveapplication/controllers/Account.php
Admins.destroyapplication/controllers/Admins.php
Appointments.storeapplication/controllers/Appointments.php
Appointments.updateapplication/controllers/Appointments.php
Customers.storeapplication/controllers/Customers.php
Customers.updateapplication/controllers/Customers.php