Headline
CVE-2023-34839: CVE-2023-34839/README.md at main · sahiloj/CVE-2023-34839
A Cross Site Request Forgery (CSRF) vulnerability in Issabel issabel-pbx v.4.0.0-6 allows a remote attacker to gain privileges via a Custom CSRF exploit to create new user function in the application.
issabel-pbx 4.0.0-6 - Cross Site Request Forgery (CSRF) to Privilege Escalation###
Description: Cross Site Request Forgery vulnerability in Issabel issabel-pbx v.4.0.0-6 allows a remote attacker to gain privileges via the a Custom CSRF exploit to create new user function in that application.
Vulnerable Product Version: issabel-pbx 4.0.0-6
Date: 23/06/2023
CVE: CVE-2023-34839
CVE Author: Sahil Ojha
Vendor Homepage: https://www.issabel.org/
Software Link: https://github.com/IssabelFoundation/issabelPBX
Tested on: Windows
Steps to reproduce:
Go to issabel PBX application and login with admin credentials.
Copy the CSRF exploit shown below and save into html file and change the hostname or domain name which is masked in the exploit for personal reason.
Open the CSRF exploit file in the same browser in another tab and as you can see a new user named “CSRF” was direclty created into the admin panel with administrator privilege.