A vulnerability classified as critical has been found in VR GPub 4.0. This affects an unknown code block of the file admin/admin_options.php. The manipulation with an unknown input leads to a cross-site request forgery vulnerability. CWE is classifying the issue as CWE-352. The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Cross-site request forgery (CSRF) vulnerability in admin/admin_options.php in VR GPub 4.0 allows remote attackers to hijack the authentication of admins for requests that add admin accounts via an add action.

The weakness was released 09/19/2012 (Website). The advisory is shared at exploit-db.com. This vulnerability is uniquely identified as CVE-2012-5005 since 09/19/2012. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details and a public exploit are known.

A public exploit has been developed in HTML and been published even before and not after the advisory. The exploit is shared for download at exploit-db.com. It is declared as highly functional. The vulnerability was handled as a non-public zero-day exploit for at least 237 days. During that time the estimated underground price was around $0-$5k. By approaching the search of inurl:admin/admin_options.php it is possible to find vulnerable targets with Google Hacking. The code used by the exploit is:

<form method="post" action="http://localhost/vrgpub/admin/admin_options.php">
<input name="ae_login" type="text" id="ae_login" size="20" maxlength="30" value="root" />
<input name="ae_mdp" type="password" id="ae_mdp" size="20" maxlength="30" value="toor" />
<input name="ae_mdp2" type="password" id="ae_mdp2" size="20" maxlength="30" value="toor" />
<p align="center">
<input type="submit" name="Submit4" value="Add" />
</p>
</form>

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at X-Force (72745) and Exploit-DB (18418).

Productinfo

Vendor

• VR

Name

• GPub

Version

• 4.0

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion