gleez/cms

CSRF Vulnerability Discovered

shellsniper opened this issue · 2 comments

shellsniper commented

Description:
CSRF (Cross-site request forgery) Vulnerability discovered in Gleez CMS v1.2.0 when I penetrate testing a couple of vulnerabilities in Demo website: https://demo.gleezcms.org.

POC:

  1. Log in as a user or admin

  2. Add new page or blog
    image

  3. Intercept POST request when a normal user or admin submitting a new page or blog,
    image

  4. Launch a CSRF attack
    image

Exec code:
image

Snippet is here:
https://github.com/levoncf/Path_of_CVE/blob/master/CSRF_POC.html

  1. Proof of Attack Successed!
    image

image

shellsniper commented

For POC, you need to gain user cookie/session by yourself, then to generate the payload