Sablog1.6 CSRF vulnerability POC

The soul of an empty prodigal soul

This test is successful in my blog, and the latest official version is successfully downloaded, but it fails in my blog.

The reason is that he modified the source program and determined the referer.

POC:

SHELL code
When commenting, website address input: http://www.inbreak.net/blog

Then the content is: Hello, can you give me a link?

After the Administrator logs on to the background, if you click your homepage, an account will be added to the background.

Hackedbykxlzx

Then you can use this account to log on, modify the template, edit the PHP file, and create a shell.

The Administrator clicked the home page and saw a page, saying that the address is incorrect.

Two important files. The first one is
Http://www.inbreak.net/blog/index.php
Is it confusing? The Administrator first saw this.
Here is an iframe pointing to the second

Yes
Http://www.inbreak.net/kxlzxtest/testxss/sablog.php

Click here to add users.

When the Administrator accesses the service, the user is added.