UBUNTU-CVE-2013-7233

Cross-site request forgery CSRF vulnerability in the retrospam component in wp-admin/options-discussion.php in WordPress 2.0.11 and earlier allows remote attackers to hijack the authentication of administrators for requests that move comments to the moderation list...

CVE-2013-7233

CVE-2013-7233 is a CSRF vulnerability in WordPress

ThinkSAAS某处CSRF导致直接GETSHELL

简要描述： ThinkSAAS某处CSRF导致直接GETSHELL 详细说明： 看看系统升级的代码： None 把此为页面的链接发送给管理员，管理员点击即可拿到shell。...

[OWASP CSRFTester] Facilitates Ability to Test Applications for CSRF

OWASP CSRFTester is a tool for testing CSRF vulnerability in websites. Just when developers are starting to run in circles over Cross Site Scripting, the 'sleeping giant' awakes for yet another web-catastrophe. Cross-Site Request Forgery CSRF is an attack whereby the victim is tricked into loadin...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in CRU Ditto Forensic FieldStation with firmware before 2013Oct15a allows remote attackers to hijack the authentication of administrators for requests that modify the disk erase technique settings via unspecified vectors...

CVE-2013-6883

CVE-2013-6883 describes a CSRF vulnerability in the CRU Ditto Forensic FieldStation, affecting firmware before 2013-Oct-15a. The issue allows remote attackers to hijack an administrator’s authentication to perform actions that modify the device’s disk-erase technique settings via unspecified vect...

CVE-2013-6192

HP Operations Orchestration is affected by CVE-2013-6192 through CSRF in versions earlier than 9, which could allow remote attackers to hijack user sessions via unknown vectors. The vulnerability is documented with a base CVSS-like impact as partial impact to confidentiality, integrity, and avail...

PBBoard Version 3.0.0 CSRF Vulnerability

Exploit for php platform in category web applications This is private exploit. You can buy it at https://0day.today...

Beetel TC1-450 Airtel Wireless Router - Multiple CSRF Vulnerabilities

Exploit for hardware platform in category web applications Technical Details Beetel 450-TC1 Wireless Router has a Cross Site Request Forgery Vulnerability in its Web Console. Attacker can easily change Wireless password,Reboot Router, Reset Router,Change Router's Admin Password by simply making t...

Piwigo 2.5.3 Cross Site Request Forgery

Exploit Title: Piwigo 2.5.3 CMS:Multiple vulnerability's Author: sajith version: Piwigo 2.5.3 Vendor Homepage: http://piwigo.org vulnerable app link:http://www.piwigo.org/basics/downloads 1 Stored XSS on Multiple parameters click on Add photos http://127.0.0.1/cms/piwigo/admin.php?page=photosadd...

X7 CHAT 2.0.2 CSRF (add admin) vulenrability

Exploit for php platform in category web applications X-------------------------------------------------------------X | | | | | \ | | / | |/ \ | \ | | / \ \ / / \ | \ | | | | | | | | | | \ --. | | / /\ | | | | / /\ V /| |/ / | | |/ / | | | | | | . | | | --. \ | | | || . | | | \ / | \ || / | | |...

ThinkSAAS某功能设计不当可能导致可以csrf后台GETSHELL

简要描述： ThinkSAAS某处处存在任意文件操作，利用CSRF直接前台导致GETSHELL 详细说明： 首先这里存在问题的是后台系统管理的数据备份还原处。 这里没有过滤sql参数，直接带入，拼接data/baksql/目录，然后进入恢复数据 这里在恢复是判断有没有分卷，没有分卷就直接恢复了，没有处理所要备份的sql文件的路径，类型，内容等，导致操作任意文件。 然后来看看这里数据恢复的操作： 我们抓个包： 我们在前台上传一个图片，图片内容为： Drop TABLE IF EXISTS temp; Create TABLE tempcmd text NOT NULL; Insert IN...

CSRF Horde Groupware Web mail Edition

Exploit Title : CSRF Horde Groupware Web mail Edition Author:Marcela Benetrix Date: 10/28/13 version: 5.1.2 software link:http://www.horde.org/apps/webmail GroupWare Web mail Edition Horde Groupware Webmail Edition is a free, enterprise ready, browser based communication suite. Users can read, se...

Ovidentia 7.9.6 - Multiple Vulnerabilities

Exploit Title: Ovidentia 7.9.6 Multiple Vulnerabilities Author: sajith version: Ovidentia 7.9.6 Vendor Homepage: http://www.ovidentia.org/ vulnerable app link:http://www.ovidentia.org/telecharger 1SQL injection vulnerability Log into admin panel and access delegate functionality managing...

TP-Link TD-8840t - Cross-Site Request Forgery

Exploit Title: TP-Link TD-8840t CSRF Vulnerability Author: MOHAMMED AL-SAGGAFLEGNED-SEIYUN E-mail: [email protected]/mohammed.alsaggaf2010 Category: Hardware Google Dork: N/A Vendor: http://www.tp-link.com Firmware Version: 3.0.0 Build 120531 Product:...

CVE-2013-6852

Cross-site request forgery CSRF vulnerability in html/json.html on HP 2620 switches allows remote attackers to hijack the authentication of administrators for requests that change an administrative password via the setPassword method...

CVE-2013-4555

Cross-site request forgery CSRF vulnerability in ecrire/action/logout.php in SPIP before 2.1.24 allows remote attackers to hijack the authentication of arbitrary users for requests that logout the user via unspecified vectors...

UBUNTU-CVE-2013-4555

Cross-site request forgery CSRF vulnerability in ecrire/action/logout.php in SPIP before 2.1.24 allows remote attackers to hijack the authentication of arbitrary users for requests that logout the user via unspecified vectors...

WBR-3406 Wireless Broadband NAT Router - Web-Console Password Change Bypass / Cross-Site Request Forgery

----------------------------------------------------------- WBR-3406 Wireless Broadband NAT Router Web-Console Password Change Bypass & CSRF Vulnerability This PoC code should do two main things: 1. Cross Site Request Forgery For more information, just google it. 2. This code change to new passwo...

CVE-2013-6357

Cross-site request forgery CSRF vulnerability in the Manager application in Apache Tomcat 5.5.25 and earlier allows remote attackers to hijack the authentication of administrators for requests that manipulate application deployment via the POST method, as demonstrated by a...