{"record":{"id":"0b856ed6a54695be","repo":"digininja/DVWA","slug":"no-token-passed","errorCode":null,"errorMessage":"No token passed","messagePattern":"No token passed","errorType":"validation","errorClass":"Exception","httpStatus":null,"severity":"warning","filePath":"vulnerabilities/cryptography/source/medium.php","lineNumber":19,"sourceCode":"<?php\nfunction decrypt ($ciphertext, $key) {\n\t$e = openssl_decrypt($ciphertext, 'aes-128-ecb', $key, OPENSSL_PKCS1_PADDING);\n\tif ($e === false) {\n\t\tthrow new Exception (\"Decryption failed\");\n\t}\n\treturn $e;\n}\n\n$key = \"ik ben een aardbei\";\n\n$errors = \"\";\n$success = \"\";\n$messages = \"\";\n\nif ($_SERVER['REQUEST_METHOD'] == \"POST\") {\n\ttry {\n\t\tif (!array_key_exists ('token', $_POST)) {\n\t\t\tthrow new Exception (\"No token passed\");\n\t\t} else {\n\t\t\t$token = $_POST['token'];\n\t\t\tif (strlen($token) % 32 != 0) {\n\t\t\t\tthrow new Exception (\"Token is in wrong format\");\n\t\t\t} else {\n\t\t\t\t$decrypted = decrypt(hex2bin ($token), $key);\n\n\t\t\t\t$user = json_decode ($decrypted);\n\t\t\t\tif ($user === null) {\n\t\t\t\t\tthrow new Exception (\"Could not decode JSON object.\");\n\t\t\t\t}\n\n\t\t\t\tif ($user->user == \"sweep\" && $user->ex > time() && $user->level == \"admin\") {\n\t\t\t\t\t$success = \"Welcome administrator Sweep\";\n\t\t\t\t} else {\n\t\t\t\t\t$messages = \"Login successful but not as the right user.\";\n\t\t\t\t}\n\t\t\t}","sourceCodeStart":1,"sourceCodeEnd":37,"githubUrl":"https://github.com/digininja/DVWA/blob/5d5c76cced604e54462b13723f5c69af58e78748/vulnerabilities/cryptography/source/medium.php#L1-L37","documentation":"First validation in the medium-level POST handler: it demands a 'token' key in $_POST before any length, decryption, or JSON checks run. It fires purely on request shape - the value may be empty and still pass, only the presence of the parameter matters.","triggerScenarios":"Sending a crafted POST (curl, Burp Repeater, fetch from a console) with no token parameter at all; removing the textarea from the DOM before submitting so the browser omits the field; renaming the form input so the posted name is no longer 'token'; scanners that probe the endpoint with empty bodies.","commonSituations":"Scripted clients and security scanners dropping optional-looking parameters; refactors that rename form fields without updating server-side key expectations; automated form-filling tools that clear and remove inputs.","solutions":["Include a token field in the POST body, e.g. curl -d 'token=<hex token>'.","If using the web form, make sure the textarea keeps name='token' inside the form element.","When scripting, set Content-Type to application/x-www-form-urlencoded so the body is parsed into $_POST."],"exampleFix":"<!-- before: input stripped or renamed -->\n<!-- after -->\n<textarea id='token' name='token'></textarea>","handlingStrategy":"validation","validationCode":"document.forms.ecb.addEventListener('submit', function (e) {\n    var token = document.getElementById('token').value.trim();\n    if (token === '') {\n        e.preventDefault();\n        alert('Paste a token before submitting.');\n    }\n});","typeGuard":null,"tryCatchPattern":"} catch (Exception $e) {\n    $errors = match ($e->getMessage()) {\n        'No token passed' => 'Paste a token before submitting.',\n        default => $e->getMessage(),\n    };\n}","preventionTips":["Keep required form fields present and named exactly as the server expects.","Add client-side required/validation checks to fail fast before the POST.","When scripting requests, always send the full expected parameter set with the correct Content-Type."],"tags":["php","form-validation","post","request-parameter","dvwa"],"backgroundTag":"missing-request-parameter","analyzedSha":"5d5c76cced604e54462b13723f5c69af58e78748","analyzedAt":"2026-08-21T01:20:26.904Z","schemaVersion":2},"datasetVersion":"2026-08-21T03:17:12.404Z"}