CVE-2009-4092 PoC — Simplog "user.php" 跨站请求伪造漏洞

Source

https://github.com/xiaoyu-iid/Simplog-Exploit

Associated Vulnerability

Title:Simplog "user.php" 跨站请求伪造漏洞 (CVE-2009-4092)
Description:Cross-site request forgery (CSRF) vulnerability in user.php in Simplog 0.9.3.2, and possibly earlier, allows remote attackers to hijack the authentication of administrators and users for requests that change passwords.

Description

Setup, exploit and patch for CVE-2009-4092 Simplog CSRF

Readme

# Simplog-Exploit

This repository contains the setup, exploit and patch for CVE-2009-4092 Simplog CSRF Vulnerability.

The vulnerabily exists in the user.php file of Simplog 0.9.3.2, a web application used for providing people with an easy way to create and maintain a blog on their personal websites. Attackers can use cross-site request forgery (CSRF) to hijack the user authentication process by sending a malicious request to change the password.

# Setup
Our setup includes an Apache webserver (on localhost) capable of handling PHP pages, and a MySQL database hosted on the same server.

# Exploit

# Patch

# Disclaimer
Simplog 0.9.3.2 is created by Jeremy Ashcraft (ashcraft@13monkeys.com). It is free software, released under GNU GPL Licence version 2.0.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →