User Registration & Login and User Management System 2.1 – Cross Site Request Forgery - 体验盒子

作者： Dipak Panchal

日期： 2020-12-03

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/49180/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

# Exploit Title: User Registration & Login and User Management System 2.1 - Cross Site Request Forgery

# Exploit Author: Dipak Panchal(th3.d1p4k)

# Vendor Homepage: https://phpgurukul.com

# Software Link: http://user-registration-login-and-user-management-system-with-admin-panel

# Version: 5

# Tested on Windows 10

Attack Vector:

An attacker can craft HTML page containing POST information to have the

victim sign into an attacker's account, where the victim can add

information assuming he/she is logged into the correct account, where in

reality, the victim is signed into the attacker's account where the changes

are visible to the attacker.

Exploit:

<html>

<body>

</form>

</body>

</html>

Mitigation:

Please add a csrf token to login request or make some type prompt that the

session has ended when the new login from attacker occurs.