SMF 2.0.11 account fixation "attack"

[qc]

While looking into the previous issue, I stumbled over the following: http://quizcommunity.de/login.html (click on it while logged out)

There is no CSRF token validation on the login form which enables malicious users to log another user into a predefined user account by making that other user click on a link (or via hidden iframe and whatnot...)

All sensitive data posted or send (e. g. PMs) from within the predefined account can now be read by both users.

This is nothing big, but could be misused by the occasional troll every forum has to deal with. A fix would require a CSRF token to be validated on index.php?action=login2. I noticed that there is already a CSRF token on this sites login form, but it seems to be ignored.

[qc]

Actually, this is an issue that should be fixed since it increases the attack surface of SMF quite a bit (to the active SMF developers: see my privately reported issue). It allows for a 'real' session fixation attack in the sense that the PHPSESSID of the to-be-logged-in victim is given by the attacker.

[qc]

This issue is still present in SMF 2.0.12

[live627]

Fixed in 2.0.14 https://custom.simplemachines.org/upgrades/index.php?action=upgrade;file=smf_patch_2.0.14.tar.gz;smf_version=2.0.13#sources_loginout-php_2