Exploits / Vulnerability Discovered : 2021-06-18 |
Type : webapps |
Platform : php
This exploit / vulnerability Ice hrm 29.0.0.os account takeover crosssite request forgery (csrf) is for educational purposes only and if it is used you will do on your own risk!
[+] Code ...
# Exploit Title: ICE Hrm 29.0.0.OS - 'Account Takeover' Cross-Site Request Forgery (CSRF)
# Exploit Author: *Piyush Patil* & Rafal Lykowski
# Vendor Homepage: https://icehrm.com/
# Version: 29.0.0.OS
# Tested on: Windows 10 and Kali
#Description
ICE Hrm Version 29.0.0.OS is vulnerable to CSRF which allows attacker to add new admin account or change the password leading to full account takeover.
#Steps to reproduce the attack:
1- Login as victim
2- Open the CSRF malicious file which I have attached (csrf_POC.html)