POC详情： be0c549af2ff46745bc891cd0dc2681a2554e310

来源
https://github.com/emirhanerdogu/CVE-2023-47014-Sticky-Notes-App-Using-PHP-with-Source-Code-v1.0-CSRF-to-CORS
关联漏洞
标题： SourceCodester Sticky Notes 安全漏洞 (CVE-2023-47014)
描述：SourceCodester Sticky Notes是一个便签应用。 SourceCodester Sticky Notes v.1.0存在安全漏洞，该漏洞源于存在跨站请求伪造(CSRF)漏洞，允许本地攻击者通过精心设计的载荷获取敏感信息。
介绍
# CVE-2023-47014-Sticky-Notes-App-Using-PHP-with-Source-Code-v1.0-CSRF-to-CORS

Exploit Author: emirhanerdogu

# Vendor Homepage

https://www.sourcecodester.com/php/16928/sticky-notes-app-using-php-source-code.html

# Software Link

https://www.sourcecodester.com/download-code?nid=16928&title=Sticky+Notes+App+Using+PHP+with+Source+Code

# Overview

Cross Site Request Forgery vulnerability in Remyandrade Sticky Notes
App Using PHP with Source Code v.1.0 allows a remote attacker to obtain sensitive information via a crafted payload to the add-note.php component.

# Vulnerability Details

CVE ID: CVE-2023-47014.  
Affected Version: Sticky-Notes V1.0  
Vulnerable File: Origin  
Parameter Names: -  
Attack Type: Local  

# Description

When the Origin header information is added in the annotation field, the CORS vulnerability does not occur. However, when the CSRF PoC was created and the Burp Collaborator address was added to it, the CORS vulnerability was triggered.

# Proof of Concept (PoC) :

Request and Response:

![image](https://github.com/emirhanerdogu/CVE-2023-47014-Sticky-Notes-App-Using-PHP-with-Source-Code-v1.0-CSRF-to-CORS/assets/32299032/4e7dfd72-6f00-4165-abe1-17f70482c51a)

CSRF PoC:

![image](https://github.com/emirhanerdogu/CVE-2023-47014-Sticky-Notes-App-Using-PHP-with-Source-Code-v1.0-CSRF-to-CORS/assets/32299032/cecd15b3-f7dc-4c97-8d41-f377440647db)

![image](https://github.com/emirhanerdogu/CVE-2023-47014-Sticky-Notes-App-Using-PHP-with-Source-Code-v1.0-CSRF-to-CORS/assets/32299032/f7fe9761-7f34-411b-9e19-9aad9f67563b)

Exploit:

![image](https://github.com/emirhanerdogu/CVE-2023-47014-Sticky-Notes-App-Using-PHP-with-Source-Code-v1.0-CSRF-to-CORS/assets/32299032/92ff35bc-6b3b-43a4-8014-d6dcc9752238)
文件快照

 [4.0K]  /data/pocs/be0c549af2ff46745bc891cd0dc2681a2554e310
└── [1.7K]  README.md

0 directories, 1 file
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
    3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。