CVE-2021-37366

Vulnerability

CTparental versions before 4.45.03 are vulnerable to cross-site request forgery (CSRF) in the admin panel [1]. The vulnerability allows an attacker to forge requests that cancel content filtering for all standard users, by combining CSRF with an XSS flaw.

Exploitation

An attacker needs to trick an authenticated administrator into clicking a malicious link while logged into the CTparental admin panel. No special network position is required; the attack can be performed remotely via social engineering. The attacker can craft a request that cancels filtering for all standard users.

Impact

Successful exploitation results in the deactivation of content filtering for all standard users, bypassing parental controls. This compromises the integrity of the filtering system and may expose users to inappropriate content. The CVSS score is 8.8 (High) [1].

Mitigation

The vulnerability is fixed in version 4.45.03, released as per the maintainer's acknowledgment [1]. Users should upgrade to CTparental 4.45.03 or later. No workarounds are mentioned.