Thelia Back Office Default Template
Monthly
Cross-site request forgery in Thelia's back office lets a crafted link or hostile page make a logged-in administrator delete, hide or reorder catalogue and configuration objects without any error or audit entry. All Thelia releases before 3.2.0 are affected: the single per-session CSRF token is rendered into URL query strings (so it leaks through access logs, browser history, HTTP Referer headers or any XSS on the admin domain), and the setToggleVisibilityAction and updatePositionAction routes inherited from AbstractCrudController performed state changes without any token check, making toggles and reordering exploitable as pure CSRF with no token theft at all. The attacker needs no privileges (CVSS PR:N) but exploitation requires a currently authenticated back-office administrator to actively click the link, since anonymous requests are redirected to /admin/login; a public proof-of-concept reference exists in the vendor advisory, it is not verified as working exploit code, and there is no indication of active exploitation at time of analysis.
Cross-site request forgery in Thelia's back office lets a crafted link or hostile page make a logged-in administrator delete, hide or reorder catalogue and configuration objects without any error or audit entry. All Thelia releases before 3.2.0 are affected: the single per-session CSRF token is rendered into URL query strings (so it leaks through access logs, browser history, HTTP Referer headers or any XSS on the admin domain), and the setToggleVisibilityAction and updatePositionAction routes inherited from AbstractCrudController performed state changes without any token check, making toggles and reordering exploitable as pure CSRF with no token theft at all. The attacker needs no privileges (CVSS PR:N) but exploitation requires a currently authenticated back-office administrator to actively click the link, since anonymous requests are redirected to /admin/login; a public proof-of-concept reference exists in the vendor advisory, it is not verified as working exploit code, and there is no indication of active exploitation at time of analysis.