发布 2018-08-27 漏洞条目

Gleez CMS 1.2.0 – Cross-Site Request Forgery (Add Admin)

Exploit Source

# Exploit Title: Gleez CMS 1.2.0 - Cross-Site Request Forgery (Add Admin)

# Date: 2018-08-24

# Exploit Author: GunEggWang

# Vendor Homepage: https://gleezcms.org/

# Software Link: https://github.com/gleez/cms

# Version: 1.2.0

# CVE : CVE-2018-15845

# Description:

# There is a CSRF vulnerability that can add an administrator account in

# Gleez CMS 1.2.0 via admin/users/add. (https://github.com/gleez/cms/issues/800)

# After the administrator logged in,open the POC,that will create an new admin account unexcused.

# POC:

<html>

<body>

</form>

</body>

</html>

相关漏洞条目