New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CSRF one click delete user #162

Open

e0mlja opened this issue Oct 21, 2019 · 0 comments

e0mlja commented Oct 21, 2019

Affected software:MineWebCMS_v1.7.0
Type of vulnerability: XSS (Stored)
Discovered by: yzc

Through the following POC, the administrator can delete the child tiger existing in the system without knowing it.

url：http://172.16.7.33/MineWebCMS/admin/user/delete/3
poc：

<script>history.pushState('', '', '/')</script>

You can change other numbers, such as 3 in the URL, delete different accounts

Through CSRF, the administrator can delete the user's account without knowing it, resulting in serious consequences.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment