DamiCMS 6.0.0 – Cross-Site Request Forgery (Change Admin Password) - 体验盒子

作者： Autism_JH

日期： 2018-08-31

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/45314/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

# Exploit Title: DamiCMS 6.0.0 - Cross-Site Request Forgery (Change Admin Password)

# Author: Autism_JH

# Date: 2018-08-30

# Vendor Homepage: https://github.com/731276192/damicms

# Software Link: https://github.com/731276192/damicms

# Version: 6.0.0

# CVE: CVE-2018-15844

# Description:

# DamiCMS v6.0.0 allows CSRF to change the administrator account's pssword.

# After the administrator login in,open the poc,the administrator account's

# password will been changed to 123123

# POC:

<html>

<body>

</form>

</body>

</html>