Cross-Site Request Forgery

Cross Site Request Forgery CSRF occurs when an authenticated user is tricked into clicking on a link which would automatically submit a request without the user's consent. This can be made possible when the request does not include an anti-CSRF token, generated each time the request is visited an...

Mail.ru: [allods.mail.ru] Cross-Site Request Forgery (Add-Item)

Hi, I found that there is no anti-csrf while adding an item for '/media.php' in allods.mail.ru, from 'https://allods.mail.ru/media.php?do=additem&section=2' since there was no anti-csrf token, there was still an extra layer of security for csrf which I had to bypass! More Details: The upload...

Hak5 WiFi Pineapple 2.4 - Preconfiguration Command Injection (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Hak5 WiFi Pineapple Preconfiguration Command Injection', 'Description' = %q This module exploits a command injection...

Hak5 WiFi Pineapple Preconfiguration Command Injection 2

This Metasploit module exploits a command injection vulnerability on WiFi Pineapples versions 2.0 and below and pineapple versions prior to 2.4. We use a combination of default credentials with a weakness in the anti-csrf generation to achieve command injection on fresh pineapple devices prior to...

Subrion CMS 4.0.5 - Cross-Site Request Forgery Bypass Persistent Cross-Site Scripting

Subrion CMS 4.0.5 - Cross-Site Request Forgery Bypass Persistent Cross-Site Scripting Exploit Title: Subrion CMS 4.0.5 - CSRF Bypass to Persistent XSS and Add-Admin Date: 15-10-2016 Software Link: http://www.subrion.org/download/ Vendor: http://www.subrion.org Google Dork: "Powered by Subrion CMS...

Subrion CMS 4.0.5 - Cross-Site Request Forgery Bypass / Persistent Cross-Site Scripting

Exploit Title: Subrion CMS 4.0.5 - CSRF Bypass to Persistent XSS and Add-Admin Date: 15-10-2016 Software Link: http://www.subrion.org/download/ Vendor: http://www.subrion.org Google Dork: "Powered by Subrion CMS" Exploit Author: Ahsan Tahir Contact: https://twitter.com/AhsanTahirAT |...

Subrion CMS 4.0.5 Cross Site Request Forgery / Cross Site Scripting

Exploit Title: Subrion CMS 4.0.5 - CSRF Bypass to Persistent XSS and Add-Admin Date: 15-10-2016 Software Link: http://www.subrion.org/download/ Vendor: http://www.subrion.org Google Dork: "Powered by Subrion CMS" Exploit Author: Ahsan Tahir Contact: https://twitter.com/AhsanTahirAT |...

CumulusClips 2.4.1 Code Execution / CSRF / Cross Site Scripting

Exploit Title: CumulusClips Session fixation Google Dork: inurl:/cumulusclips/videos/ Date: 2.09.2016 Exploit Author: kor3k / Aukasz Korczyk Vendor Homepage: http://cumulusclips.org/ Software Link: http://cumulusclips.org/cumulusclips.zip Version: 2.4.1 Tested on: Debian Jessie Description:...

CumulusClips 2.4.1 - Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title: CumulusClips Session fixation Google Dork: inurl:/cumulusclips/videos/ Date: 2.09.2016 Exploit Author: kor3k / Łukasz Korczyk Vendor Homepage: http://cumulusclips.org/ Software Link: http://cumulusclips.org/cumulusclips.zip...

Mail.ru: [cfire.mail.ru] CSRF Bypassed - Changing anyone's 'User Info'

Hi, I noticed that when we change userinfo of https://cfire.mail.ru from here: https://cfire.mail.ru/account/userinfo, there are two Anti-CSRF tokens or you can say that; they just do the work of Anti-CSRF token: - signature - submit2 Actually, I was able to bypass both Anti-CSRF tokens, and afte...

Multiple RCEs via CSRF in Dolibarr

High-Tech Bridge Security Research Lab discovered multiple CSRF vulnerabilities in a popular ERP and CRM software Dolibarr. Discovered vulnerabilities may allow remote attacker to run arbitrary commands on vulnerable system via CSRF vector. Successful exploitation of the vulnerabilities can lead ...

PHPList 3.2.4 Cross Site Request Forgery / Cross Site Scripting

Exploit Title: PHPList v3.2.4 CSRF/XSS Date: 01/06/2016 Author: Mickael Dorigny @ Synetis Vendor or Software Link: https://www.phplist.com/ Version: 3.2.4 Category: CSRF/XSS PHPList description : ====================================================================== phpList is an open source...

Paragon Initiative Enterprises: The Anti-CSRF Library fails to restrict token to a particular IP address when being behind a reverse-proxy/WAF

The Anti-CSRF Library provides the ability to restrict token to a particular IP address using the variable "$hmacip". When "$hmacip" is set to "true", the token is generated using the predefined variable "$SERVER'REMOTEADDR'" which gives the IP address of the client. However, when the web server ...

Concrete CMS: ProBlog 2.6.6 CSRF Exploit

Report Because the ProBlogs plugin did not validate the anti-csrf token on a POST request. A victim who is logged in could be fooled into clicking a malicious form styled to look like a link, image, etc which would create a page in their C5 website. Because the ProBlogs plugin does not validate t...

WordPress leenk.me 2.5.0 Cross Site Request Forgery / Cross Site Scripting

I would like to disclose CSRF and stored XSS vulnerability in Wordpress plugin LeenkMe version 2.5.0. The plugin can be found at https://wordpress.org/plugins/leenkme/ In the page wp-content/plugins/leenkme/facebook.php XSS vulnerable Fields are : - facebookmessage - facebooklinkname -...

WordPress leenk.me 2.5.0 Plugin - Cross-Site Request Forgery / Cross-Site Scripting

Exploit for php platform in category web applications I would like to disclose CSRF and stored XSS vulnerability in Wordpress plugin LeenkMe version 2.5.0. The plugin can be found at https://wordpress.org/plugins/leenkme/ In the page wp-content/plugins/leenkme/facebook.php XSS vulnerable Fields a...

WordPress Plugin leenk.me 2.5.0 - Cross-Site Request Forgery Cross-Site Scripting

WordPress Plugin leenk.me 2.5.0 - Cross-Site Request Forgery Cross-Site Scripting I would like to disclose CSRF and stored XSS vulnerability in Wordpress plugin LeenkMe version 2.5.0. The plugin can be found at https://wordpress.org/plugins/leenkme/ In the page...

TeamPass 2.1.24 - Multiple Vulnerabilities

Affected Product: TeamPass Vulnerability Type: Multiple XSS,CSRF, SQL injections Fixed in Version: 2.1.25 https://github.com/nilsteampassnet/TeamPass/releases/tag/2.1.25.0 Vendor Website: http://www.teampass.net Software Link: : https://github.com/nilsteampassnet/TeamPass Affected Version: 2.1.24...

[CVE-2015-4624] Predictable CSRF tokens in WiFi Pineapple firmware <= 2.3.0

Overview =============== WiFi Pineapples are a penetration testing tool used in offensive wireless activities. These devices run on a modified OpenWRT based on netBSD operating system. They include a web-based management interface. It has been discovered they have predictable anti-CSRF tokens bas...

Hak5 WiFi Pineapple Preconfiguration Command Injection

This module exploits a command injection vulnerability on WiFi Pineapples version 2.0 use exploit/linux/http/pineapple/preconfigcmdinject msf undefinedpreconfigcmdinject show actions ...actions... msf undefinedpreconfigcmdinject set ACTION msf undefinedpreconfigcmdinject show options ...show and...