LFCMS 3.7.0 – Cross-Site Request Forgery (Add User) - 体验盒子

作者： bay0net

日期： 2018-06-21

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/44918/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

# Exploit Title: A CSRF vulnerability exists in LFCMS_3.7.0: users can be added arbitrarily.

# Date: 2018-06-20

# Exploit Author: bay0net

# Vendor Homepage: https://www.cnblogs.com/v1vvwv/p/9203740.html

# Software Link: http://www.lfdycms.com/home/down/index/id/26.html

# Version: 3.7.0

# CVE : CVE-2018-12602

A CSRF vulnerability exists in LFCMS_3.7.0: users can be added arbitrarily.

The payload for attack is as follows.

<html>

<body>

</form>

</body>

</html>