sahiloj / CVE-2023-37597

CSRF vulnerability in issabel-pbx 4.0.0-6 to delete any user group

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

issabel-pbx 4.0.0-6 - Cross Site Request Forgery (CSRF) to delete any user group

Description: Cross Site Request Forgery (CSRF) vulnerability in issabel-pbx v.4.0.0-6 allows a remote attacker to make the application not accessible to users group by exploiting delete user grouplist function in the application.

Vulnerable Product Version: issabel-pbx 4.0.0-6

Date: 10/07/2023

CVE: CVE-2023-37597

CVE Author: Sahil Ojha

Vendor Homepage: https://www.issabel.org/

Software Link: https://github.com/IssabelFoundation/issabelPBX

Tested on: Windows

Attack scenario:
When this CSRF exploit is hosted somewhere and users open or interact with this exploit in his browser with logged in session of issable application, user group will be deleted automatically from the admin panel.

Steps to reproduce:

  1. Go to URL: https://{Issabel IP}/index.php?menu=grouplist&action=view&id=11 and login with admin credentials.

    HTML Render

  2. Attempt to delete the user group and capture the request in burp suite proxy, right-click on the request and go to “Engagement Tools --> Generate CSRF PoC”.

    HTML Render

  3. Upon generating the CSRF exploit code shown below, copy the script and save it as html file.

  4. Send this file to the already logged-in user and when the user clicks on submit request the user group will be deleted as shown in the figure below.

    HTML Render

    HTML Render

About

CSRF vulnerability in issabel-pbx 4.0.0-6 to delete any user group


Languages

Language:HTML 100.0%