OpenCMS 10.5.3 – Cross-Site Request Forgery

Exploit Database
124 阅读

作者： Sureshbabu Narvaneni

日期： 2018-04-02
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/44391/

# Exploit Title: OpenCMS 10.5.3 Multiple Cross Site Request Forgery Vulnerabilities

Injection

# Google Dork: N/A

# Date: 02-04-2018

#######################################

# Exploit Author: Sureshbabu Narvaneni

# Author Blog : http://nullnews.in

# Vendor Homepage: http://www.opencms.org/en/

# Software Link: http://www.opencms.org/en/modules/downloads/begindownload.html?id=a7747cd0-b27b-11e7-8299-7fde8b0295e1

# Affected Version: 10.5.3

# Category: WebApps

# Tested on: Ubuntu 14.04 x86_64/Kali Linux 4.12 i686

# CVE : CVE-2018-8811

1. Vendor Description:

OpenCms from Alkacon Software is a professional, easy to use website content management system. OpenCms helps content managers worldwide to create and maintain beautiful websites fast and efficiently.

2. Technical Description:

Cross-site request forgery (CSRF) vulnerability in system/workplace/admin/accounts/user_role.jsp in OpenCMS 10.5.3 allows remote attackers to hijack the authentication of administrative users for requests that perform privilege escalation.

3. Proof Of Concept:

a) Send below crafted request to logged in user who is having Root Administrator level access.

<html>

<body>

</form>

</body>

</html>

b) Once the logged in user opens the URL the form will get submitted with active session of root administrator and action get performed successfully.

c) By leveraging this vulnerability user can gain Root Level Administrator Access to the CMS.

4. Solution:

Upgrade to latest release.

http://www.opencms.org/en/home/news.html

5. Reference:

https://github.com/alkacon/opencms-core/issues/586

http://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-8811