Document Title:
===============
Phpgurukul User Registration v2.0 - Multiple Vulnerabilities
References (Source):
====================
https://www.vulnerability-lab.com/get_content.php?id=2216
Release Date:
=============
2020-04-20
Vulnerability Laboratory ID (VL-ID):
====================================
2216
Common Vulnerability Scoring System:
====================================
5.4
Vulnerability Class:
====================
Cross Site Scripting - Persistent
Current Estimated Price:
========================
500€ - 1.000€
Product & Service Introduction:
===============================
User Registration & Login and User Management System With Admin Panel v2.0.
(Copy of the Homepage:
https://phpgurukul.com/?smd_process_download=1&download_id=7003 )
Abstract Advisory Information:
==============================
The vulnerability laboratory core research team discovered multiple web
vulnerabilities in the Phpgurukul User Registration & User Management
System v2.0.
Affected Product(s):
====================
Anuj Kumar
Product: User Registration & Login and User Management System With Admin
Panel v2.0 (Web-Application)
Vulnerability Disclosure Timeline:
==================================
2020-04-20: Public Disclosure (Vulnerability Laboratory)
Discovery Status:
=================
Published
Exploitation Technique:
=======================
Remote
Severity Level:
===============
Medium
Authentication Type:
====================
No authentication (guest)
User Interaction:
=================
Low User Interaction
Disclosure Type:
================
Independent Security Research
Technical Details & Description:
================================
Multiple persistent input validation web vulnerabilities has been
discovered in the Phpgurukul User Registration & User Management System
v2.0.
The vulnerability allows remote attackers to inject own malicious script
codes with persistent attack vector to compromise browser to
web-application
requests from the application-side.
The persistent cross site web vulnerabilities are located in the
`firstname` and `lastname` parameters of the registration form &
loginsystem input fields.
Remote attackers are able to register with malicious script code as
firstname or lastname to manipulate the `manage-users.php` and
`update-profile.php`
files visible for administrators in the backend. The injection point is
the registration or user edit module and the execution occurs on
manage-users
preview or user edits. The request method to inject is POST and the
attack vector is located on the application-side.
Successful exploitation of the vulnerabilities results in session
hijacking, persistent phishing attacks, persistent external redirects to
malicious source and persistent manipulation of affected application
modules.
Request Method(s):
[+] POST
Vulnerable Input(s):
[+] firstname
[+] lastname
Vulnerable Module(s):
[+] Registration (Login-System)
Vulnerable Parameter(s):
[+] fname
[+] lname
Affected Module(s):
[+] Manage Users (manage-users.php)
[+] Update User (update-profile.php)
Proof of Concept (PoC):
=======================
The persistent input validation vulnerabilities can be exploited by
remote attackers without privileged user account and with low user
interaction.
For security demonstration or to reproduce the security web
vulnerability follow the provided information and steps below to continue.
Manual steps to reproduce ...
1. Open the registration formular
2. Inject payload in firstname and lastname values
3. Submit the request via POST method
4. Wait until the admin previews the users listing without any activations
Note: The execution occurs on user edit and in the user management listing
5. On preview the cookie transmits to attacker and he can login with non
expired cookie
7. Successful reproduce of the vulnerability!
--- PoC Session Logs (POST) --- (Inject)
https://localhost:8080/project/loginsystem/
Host: localhost:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:75.0)
Gecko/20100101 Firefox/75.0
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data;
boundary=---------------------------84460134629716292423840703493
Content-Length: 897
Origin: https://localhost:8080
Connection: keep-alive
Referer: https://localhost:8080/project/loginsystem/
Cookie: _ga=GA1.2.399488116.1587293169; _gid=GA1.2.865518164.1587293169;
PHPSESSID=92276d293892927eea41e64e19c214a4
fname=test1>"&lname=test2>"&email=keymaster31337@protonmail.com&password=whoami23&contact=31337317&signup=Sign
Up
-
POST: HTTP/2.0 200 OK
server: Apache
x-powered-by: PHP/7.2.21
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
content-encoding: gzip
vary: Accept-Encoding,User-Agent
content-type: text/html; charset=UTF-8
X-Firefox-Spdy: h2
PoC: Vulnerable Source (Execution Point - manage-users.php)