CVE-2011-5074 in Support Incident Tracker
Summary
by MITRE
Multiple cross-site request forgery (CSRF) vulnerabilities in Support Incident Tracker (aka SiT!) before 3.65 allow remote attackers to hijack the authentication of administrators for requests that change administrator email, add a new administrator, or insert arbitrary script via (1) user_profile_edit.php or (2) user_add.php.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 01/17/2025
The CVE-2011-5074 vulnerability represents a critical cross-site request forgery flaw discovered in the Support Incident Tracker (SiT!) web application prior to version 3.65. This vulnerability resides in the application's authentication and authorization mechanisms, specifically affecting administrative functions that manage user accounts and system configuration. The flaw enables remote attackers to exploit the trust relationship between authenticated administrators and the web application, potentially leading to complete administrative compromise and unauthorized access to sensitive system resources.
The technical implementation of this CSRF vulnerability stems from the absence of proper anti-CSRF tokens or validation mechanisms in two key administrative pages: user_profile_edit.php and user_add.php. When administrators navigate to these pages, the application fails to verify the authenticity of requests originating from legitimate administrative sessions. Attackers can craft malicious web pages or exploit existing vulnerabilities in other parts of the application to submit forged requests that appear to originate from authenticated administrators. These forged requests can manipulate critical administrative functions including changing administrator email addresses, adding new administrator accounts, or injecting malicious scripts into the system through the user management interfaces.
The operational impact of this vulnerability extends beyond simple privilege escalation, as it provides attackers with persistent administrative access to the SiT for incident management and customer support tracking, as compromised administrative accounts could lead to data breaches, service disruption, and unauthorized modifications to support workflows. The attack vector is particularly concerning because it requires no authentication credentials from the attacker, relying solely on social engineering or existing vulnerabilities to deliver malicious payloads to authenticated administrators.
Organizations should immediately implement mitigations including updating to SiT! version 3.65 or later, which addresses the CSRF vulnerabilities through proper token validation mechanisms. The implementation of anti-CSRF tokens in all administrative functions aligns with CWE-352 standards for cross-site request forgery prevention and follows ATT&CK technique T1566 for credential access through social engineering. Additional defensive measures include implementing Content Security Policy headers, enforcing strict session management practices, and conducting regular security audits of web application interfaces. Network monitoring should be enhanced to detect suspicious administrative activities, and administrators should be trained to recognize potential CSRF attack vectors. The vulnerability demonstrates the critical importance of implementing proper input validation and authentication checks in web applications, particularly those handling sensitive administrative functions.