** Note : this vulnerability is already fixed by paloalto security team # Exploit Title: Missing CSRF Token Leads to account full takeover (All accounts can be hijacked) # Google Dork: [N/A] # Date: [JUl 23 2019] # Exploit Author: Pankaj Kumar Thakur (Nepal) @Nep_1337_1998 # Vendor Homepage:https://www.paloaltonetworks.com # Software Link: N/A # Version: [8.0] # Tested on: [Parrot OS] # CVE : [N/A] # Acknowledgement: https://www.paloaltonetworks.com/security-researcher-acknowledgement summary ---------- Cross-Site Request Forgery (CSRF) is an attack that forces an end user to execute unwanted actions on a web application in which they're currently authenticated. CSRF attacks specifically target state-changing requests, not theft of data, since the attacker has no way to see the response to the forged request. Steps to generate ---------------------- >> Initially account should be authenticated >> for testing purpose i changed email address ..and account was fully takeover if html files not works then follow this steps >> go to profile setting >> change your profile details >> then intercept that request >> then generate csrf poc and then try in browser..boom! account cresdentials will be changed . PoC --- THANK YOU PANKAJ KUMAR THAKUR INDP.Security Researcher | Certified Ethical Hacker | Red Team at SYNACK Inc | OSCP