Cherry-toto / jizhicms

极致CMS(以下简称:JIZHICMS)是一款开源免费,无商业授权的建站系统。
https://www.jizhicms.cn
MIT License
173 stars 41 forks source link

Jizhicms has CSRF, which allows administrator passwords and other information to be modified #101

Open 3756048631 opened 2 weeks ago

3756048631 commented 2 weeks ago
  1. Download the latest source code and install it into PHPStudy

  2. Log in to the administrator backend, go to the page shown below, enter the information, use Burp to capture the package, and click Modify. image

  3. The data package is as follows. Use Burp Professional Edition to create a CSRF POC, remember to delete the token field in the data package

  4. image

  5. Copy the link generated by Burp Professional Edition to Firefox and successfully modify the administrator information, including password image image

Repair suggestion: It is obvious that a repair has been done here before, but it is not complete. If the token does not exist, the legitimacy of the token will not be verified.