CVE-2023-40172 Cross-Site Request Forgery (CSRF) in fobybus/social-media-skeleton

Medium 6.5 Published 18 Aug 2023 Updated 2 Oct 2024

Attackers can trick users into performing unintended actions on the social media skeleton web application due to missing CSRF protections.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2023-40172?

CVE-2023-40172 is a medium-severity vulnerability in fobybus social-media-skeleton, published on 18 Aug 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Social media skeleton is an uncompleted/framework social media project implemented using a php, css ,javascript and html. A Cross-site request forgery (CSRF) attack is a type of malicious attack whereby an attacker tricks a victim into performing an action on a website that they do not intend to do. This can be done by sending the victim a malicious link or by exploiting a vulnerability in the website. Prior to version 1.0.5 Social media skeleton did not properly restrict CSRF attacks. This has been addressed in version 1.0.5 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Weakness: CWE-352

Which versions are affected by CVE-2023-40172?

It affects 1 product.

Products include Fobybus Social-Media-Skeleton.

How do I fix CVE-2023-40172?

No fix has been published for CVE-2023-40172 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-40172 being exploited?

There is no known exploitation of CVE-2023-40172 in the wild and no public exploit code.

Sources

Also known as GHSA-873h-pqjx-3pwg.