Executive brief
Cotonti is a PHP content management framework that includes a ratings plugin for content. The ratings plugin fails to validate anti-CSRF tokens in its AJAX handler, allowing attackers to forge ratings on behalf of logged-in users by tricking them into visiting malicious pages. An attacker can manipulate stored ratings and rankings for any rated content without authorization.
Technical details
The ratings plugin AJAX handler (ratings.ajax.php) accepts POST requests to modify ratings without validating CSRF tokens, relying only on user authentication. An attacker can craft a malicious webpage that auto-submits requests to the ratings endpoint, and when visited by an authenticated user, the requests execute with that user's privileges. The vulnerability requires the victim to be logged in and to visit an attacker-controlled page, but no user interaction is needed once the page loads.
Affected products
- Cotonti Cotonti through 1.0.0
Timeline
- 2026-09-18: disclosed