GHSA-6jmh-9gqm-5xrx

Cross-Site Request Forgery (CSRF) in livehelperchat

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-0226

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	remdex/livehelperchat	< 3.92	3.92

Details

As written in the advisory (Markdown source, shown as plain text).

A CSRF issue is found in the audit configuration under settings. It was found that no CSRF token validation is getting done on the server-side. If we remove the CSRF token and keep the CSRF token field empty, the action is getting performed.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-0226 advisory
https://github.com/livehelperchat/livehelperchat/commit/f59ffb02984c0ce2fbb19ac39365066507de9370 web
https://github.com/livehelperchat/livehelperchat package
https://huntr.dev/bounties/635d0abf-7680-47f6-a277-d9a91471c73f web