发布 2012-02-20 漏洞条目

Plume CMS 1.2.4 – Cross-Site Request Forgery

Exploit Source

+--------------------------------------------------------------------------------------------------------------------------------+

# Exploit Title : PlumeCMS <= 1.2.4 CSRF Vulnerability

# Date : 20-02-2012

# Author : Ivano Binetti (http://ivanobinetti.com)

# Software link : http://sourceforge.net/projects/pxsystem/files/latest/download?source=directory

# Vendor site : http://pxsystem.sourceforge.net/

# Version : 1.2.4 (latest) and lower

# Tested on : Debian Squeeze (6.0)

+--------------------------------------------------------------------------------------------------------------------------------+

+------------------------------------------[Insert and publish NEWS by Ivano Binetti]--------------------------------------------------+

Summary

1)Vulnerability Description

2)Exploit

+---------------------------------------------------------------------------------------------------------------------------------+

1)Vulnerability Description

PlumeCMS is prone to a CSRF Vulnerability which allows an attacker to insert and publish "News" (as PlumeCMS names his articles) when an

authenticated admin browses a web page containing the following html/javascript code.

2)Exploit

<html>

<H2>CSRF Exploit to add and publish News</H2>

</form>

</body>

</html>

+----------------------------------------------------------------------------------------------------------------------------------+

相关漏洞条目