CVE-2023-37598 PoC — Issabel PBX 跨站请求伪造漏洞

Source

Associated Vulnerability

Description

CSRF vulnerability in issabel-pbx v.4.0.0-6 to delete any new virtual fax of users

Readme

## issabel-pbx 4.0.0-6 - Cross Site Request Forgery (CSRF) to delete any new virtual fax of users ###

**Description:**
Cross Site Request Forgery (CSRF) vulnerability in issabel-pbx v.4.0.0-6 allows any remote attacker to make the application data not accessible to users by exploiting delete new virtual fax function in the application.

**Vulnerable Product Version:**
issabel-pbx 4.0.0-6

**Date:**
10/07/2023

**CVE:** 
CVE-2023-37598

**CVE Author:**
Sahil Ojha

**Vendor Homepage:**
https://www.issabel.org/

**Software Link:** 
https://github.com/IssabelFoundation/issabelPBX

**Tested on:** 
Windows

**Attack scenario:**  
When this CSRF exploit is hosted somewhere and users open or interact with this exploit in his browser with logged in session of issable application, user's new virtual fax will be deleted automatically from the admin panel/dashboard.

**Steps to reproduce:**
1.	Go to URL: https://{Issabel IP}/index.php?menu=faxnew&action=view&id=1  and login with admin credentials. 

      ![HTML Render](https://github.com/sahiloj/CVE-2023-37598/blob/main/1.png)
      --
  	
3.	Attempt to delete the Virtual Fax and capture the request in burp suite proxy, right-click on the request and go to “Engagement Tools --> Generate CSRF PoC”.

      ![HTML Render](https://github.com/sahiloj/CVE-2023-37598/blob/main/2.png)
     --
  	
4.	Upon generating the CSRF exploit code shown below, copy the script and save it as html file.

5.	Send this file to the already logged-in user and when the user clicks on submit request the Virtual Fax will be deleted as shown in the figure below.

     ![HTML Render](https://github.com/sahiloj/CVE-2023-37598/blob/main/3.png)
     --

     ![HTML Render](https://github.com/sahiloj/CVE-2023-37598/blob/main/4.png)
    --

File Snapshot

 [4.0K]  /data/pocs/8316832302218579fe2fe65bf92b0bdafbe53c94
├── [190K]  1.png
├── [274K]  2.png
├── [ 29K]  3.png
├── [142K]  4.png
├── [ 357]  CSRF exploit.html
└── [1.7K]  README.md

0 directories, 6 files

Remarks