Live Call Support Widget 1.5 - Cross-Site Request Forgery Vulnerability

Exploit for php platform in category web applications Exploit Title: Live Call Support 1.5 - Cross-Site Request Forgery Add Admin Exploit Author: Ihsan Sencan Vendor Homepage: http://ranksol.com/ Software Link:...

CVE-2018-20613

TEMMOKU T1.09 Beta allows admin/user/add CSRF...

CVE-2018-20612

UWA 2.3.11 allows index.php?g=admin&c=admin&a=addadmindo CSRF...

Synaccess netBooter NP-0801DU 7.4 - Cross-Site Request Forgery (Add Admin)

Synaccess netBooter NP-0801DU 7.4 - Cross-Site Request Forgery Add Admin Title: Synaccess netBooter NP-0801DU 7.4 - Cross-Site Request Forgery Add Admin Author: Gjoko 'LiquidWorm' Krstic @zeroscience Exploit Date: 2018-11-17 Vendor: Synaccess Networks Inc. Product web page:...

Gleez CMS 1.2.0 - Cross-Site Request Forgery (Add Admin)

Gleez CMS 1.2.0 - Cross-Site Request Forgery Add Admin Exploit Title: Gleez CMS 1.2.0 - Cross-Site Request Forgery Add Admin Date: 2018-08-24 Exploit Author: GunEggWang Vendor Homepage: https://gleezcms.org/ Software Link: https://github.com/gleez/cms Version: 1.2.0 CVE : CVE-2018-15845...

CVE-2018-12739

In BEESCMS 4.0, CSRF allows administrators to be added arbitrarily, a related issue to CVE-2018-10266...

Cross site request forgery (csrf)

In BEESCMS 4.0, CSRF allows administrators to be added arbitrarily, a related issue to CVE-2018-10266...

CVE-2018-12739

BEESCMS 4.0 contains a Cross-Site Request Forgery (CSRF) vulnerability that allows an attacker to arbitrarily add administrator accounts. The issue is documented as CVE-2018-12739, linked to earlier CVE-2018-10266. Public references include exploit listings and demonstrations of the CSRF payload ...

BEESCMS 4.0 - Cross-Site Request Forgery (Add Admin) Vulnerability

Exploit for php platform in category web applications Exploit Title: A CSRF vulnerability exists in BEESCMSV4.0: The administrator can be added arbitrarily. Exploit Author: bay0net Vendor Homepage: https://www.cnblogs.com/v1vvwv/p/9226389.html Software Link: http://www.beescms.com/ Version: BEESC...

Nagios Network Analyzer 2.2.1 - Multiple Cross-Site Request Forgery

Exploit for php platform in category web applications + Credits: John Page hyp3rlinx + ISR: ApparitionSec Vendor: =============== www.nagios.com Product: ============================== Nagios Network Analyzer v2.2.1 Netflow Analysis, Monitoring, and Bandwidth Utilization Software Network Analyzer...

百为流控路由设计不当 可任意添加管理员

POST /goform/webForm HTTP/1.0 Referer: ...:2011/advance/adminuser.htm?v=20130320 Content-Type: application/x-www-form-urlencoded X-Requested-With: XMLHttpRequest Accept: / Accept-Language: zh-CN Proxy-Connection: Keep-Alive User-Agent: Mozilla/5.0 Windows NT 6.1; WOW64; Trident/7.0; rv:11.0 like...

Beijing Zixin Newspaper Technology Digital Newspaper System Cross-Site Request Forgery Vulnerability

Beijing Purple New Digital Newspaper System is a perfect, efficient, stable, reliable, flexible and scalable digital workflow management system for combined editions. Beijing Purple New Digital Newspaper System-UEP V6.5 has a cross-site request forgery vulnerability. Attackers can take advantage ...

Chmool Net 1 Unauthenticated Administrative Access

| Title : chmool net V1 Mullti Vulnerability | Author : indoushka | email : [email protected] | Dork : Ahmed Ellefy c 2014 | Tested on: win8.1 Fr V.Pro 23:09 22/05/2015 | Bug : Mullti | Download : http://www.traidnt.com ======================================= By pass Admin panel :...

KPPW最新版本(Csrf删除任意帐号/添加管理员)

简要描述： 求高Rank 么么哒 详细说明： http://localhost/KPPW/index.php?do=user&view=message&op=send http://localhost/KPPW/index.php?do=pubtask&id=1&step=step2 收件人填目标用户名 标题随便 内容没有转义 不过过滤了敏感标签和 onerror onload等事件。 先来看第一个删除任意帐号 http://localhost/KPPW/admin/index.php?do=user&view=list&op=del&edituid=5529 GET提交此URL...

ESPCMS通过csrf添加管理员

简要描述： 如题，没检验表单。 详细说明： None...

CUUMALL商场存储型xss+csrf添加超级管理员

简要描述： CUUMALL 存储型xss+csrf添加超级管理员 详细说明： 注册用户后，然后在完善用户资料后，然后进行重新编辑如图所示： 这里我们抓一次包，然后重放post数据为： shen=%E6%B9%96%E5%8C%97&shi=%E8%8D%86%E5%B7%9E%E5%B8%82&qu=%E6%B2%99%E5%B8%82%E5%8C%BA&uid=529&realname=" xsscsrfshell.js内容如下： function ajax var request = false; ifwindow.XMLHttpRequest request = new...

ASPCMS最新版CSRF添加管理员及GetShell

简要描述： 详细说明： ASPCMS最新版2.5.2 CSRF添加管理员： 后台添加管理员的请求如下： 链接：http://10.65.203.100:90/adminaspcms/user/Admin/AspCmsAdminAdd.asp?action=add POST：GroupID=1&LoginName=111111&Password=111111&AdminDesc=111111&UserStatus=1 可以看到没有防御CSRF 我们构造伪造表单： 管理员组 超级管理员组 lpyuan 普通管理员 管理员名称 管理员密码 管理员描述 状态 漏洞利用之前： img...

X7 CHAT 2.0.2 CSRF (add admin) vulenrability

Exploit for php platform in category web applications X-------------------------------------------------------------X | | | | | \ | | / | |/ \ | \ | | / \ \ / / \ | \ | | | | | | | | | | \ --. | | / /\ | | | | / /\ V /| |/ / | | |/ / | | | | | | . | | | --. \ | | | || . | | | \ / | \ || / | | |...

GigKalender v1.2 CSRF Vulnerability

Exploit for php platform in category web applications Exploit Title: GigKalender v1.2 CSRF Vulnerability Author: DaOne @LibyanCA Vendor: http://www.paderdesign.de/gigkalender/features.html CSRF Add Admin 0day.today 2018-01-09...

SePortal 2.5 CSRF Vulnerability

Exploit for php platform in category web applications Exploit Title: SePortal 2.5 CSRF Vulnerability Author: DaOne LCA Date: 19/8/2012 Software Link: http://www.seportal.org CSRF Add Admin 0day.today 2018-01-10...