Ke Lin's mobile phone self-built website system can kill CSRF in many aspects

Ke Lin's mobile phone self-built website system can kill CSRF in many aspects

This affects more than 0.1 million users. More than 20 CSRF types can be constructed.
This cms is used by the author's website of the eight gods Intelligent Network ghost, wapzz mobile webmaster's house, and so on.

The author's website using the cms with the 8 God Intelligent Network Ghost artifact and the home of wapzz mobile webmaster


 

The following is an example.

Use www.wapzz.cn as an example.

Add

Admin/addTopWAPALL. aspx? Path = 360 library plan & action = gomod & classid = 0

Url-encoded www.wapzz.cn/admin/addTopWAPALL.aspx? Path = 360% E5 % BA % 93% E5 % B8 % A6 % E8 % AE % A1 % E5 % 88% 92 & action = gomod & classid = 0

When the Administrator accesses this link, the homepage of the website will be changed to "360 library with plan.

You can also directly use the simplified link www.wapzz.cn

/Admin/addTopWAPALL. aspx? Path = 360 library plan & action = gomod & classid = 0

For example

Http://wapzz.cn/bbs/userguessbook.aspx? Action = search & siteid = 1000 & classid = 0 & touserid = 1835

When a user accesses this link, the system automatically sends a message to the user.
 

The zombie, the super-beast, Fei, the human brother, destroy your mother, force [66 Floor] [Back] Yi Xue net 07-31, I will come here, it's not my own... [65 th Floor] [Back] Yixue net 07-31 caomud Horse dead garbage Super Beast Fei human brother destroy your mother forced [61 Floor] [Back] New webmaster 147785 07-31 potholes, this is not what I sent: [60 Floor] [Back] New webmaster 147785 07-31 20:56, grass mud, horse, dead garbage, super beast, Fei, human brother, destroy your mother, force [59 Floor] [Back] Lin Xi 07- am, if you have been pitted on the [58 th Floor] [Back] and ignited on the [29 th Floor] [Back], click gbeee.com next door, and click the hyperlink. [28 th Floor] [Back] There are many other structures available for gbe next to spicy food. Users can be frozen and administrators can be added to the background. Baidu keywords: large websites with high weights.

 

Solution:

Users and administrators can construct CSRF chains with their operational permissions. You are not responsible for the website building system. Penalty