Description: Cross Site Request Forgery (CSRF) vulnerability in issabel-pbx v.4.0.0-6 allows a remote attacker to make the application not accessible to users by exploiting delete user function in the application.
Vulnerable Product Version: issabel-pbx 4.0.0-6
Date: 10/07/2023
CVE: CVE-2023-37596
CVE Author: Sahil Ojha
Vendor Homepage: https://www.issabel.org/
Software Link: https://github.com/IssabelFoundation/issabelPBX
Tested on: Windows
Attack scenario:
When this CSRF exploit is hosted somewhere and users open or interact with this exploit in his browser with logged in session of issable application, specified user with id like 1,2, etc. will be deleted automatically from the admin panel.
Steps to reproduce:
-
Go to URL: https://{Issabel IP}/index.php?menu=userlist and login with admin credentials.
-
Click on delete a user, and attempt to delete the user named ‘”><script>alert(1)</script>”’ and capture the request in burp suite proxy, right click on the request and go to “Engagement Tools --> Generate CSRF PoC”.
-
Upon generating the CSRF exploit code shown below, copy the script and save it as html file.
-
Send this file to the already logged-in user and when the user clicks on submit request, specified user will be deleted as shown in the figure below.
