Cotonti EUVD-2026-83367

Exploitation requires that the target has the Cotonti 'ratings' plugin enabled and that a victim with an authenticated session and write/rating privileges (the code checks $auth_write) visits an attacker-controlled page while logged in. The primary limiting factor is required user interaction (UI:P) - the victim must actively browse to the malicious page during a valid session - and the impact is confined to forging/modifying rating data, with no confidentiality or availability effect. No special server-side configuration beyond the default ratings plugin being active is needed.

This is a genuine but low-severity issue best characterized as a real-but-not-urgent finding. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N, vendor 5.3) correctly captures a CSRF flaw: network-reachable, low complexity, no attacker privileges, but requiring victim interaction (UI:P) and yielding only limited integrity impact (VI:L) with zero confidentiality or availability effect. No EPSS score, no CISA KEV listing, and no public exploit code are present in the input - so there is no signal of active exploitation or automatability, and no public exploit identified at time of analysis. The impact ceiling is intrinsically low: successful exploitation only forges/modifies stored rating data on behalf of a logged-in user, not account takeover or data theft. There is no conflicting-signal problem here - description, CVSS vector, CWE-352, tags, and the patch diff (adding cot_check_xg() before the rating-send handler) all agree this is a straightforward missing-anti-CSRF-token bug. Net: legitimate to patch but low real-world priority, especially given the niche product footprint.

An attacker hosts a malicious web page containing a hidden form or script that auto-submits a POST to the Cotonti ratings AJAX handler (plugins/ratings/ratings.ajax.php). When a user who is already authenticated to the target Cotonti site visits that page, their browser sends the forged request with their session cookies, silently submitting or altering a rating attributed to them. No public exploit code is identified, but the attack is trivial to construct given the missing token check.