# Exploit Title: OOP CMS BLOG 1.0 - Cross-Site Request Forgery (Delete Admin) # Exploit Author: Mr Winst0n # Author E-mail: manamtabeshekan[@]gmail[.]com # Discovery Date: March 1, 2019 # Vendor Homepage: http://zsoft.com.bd/ # Software Link : https://datapacket.dl.sourceforge.net/project/php-oop-cms-blog/blog_fo_rup.zip # Tested Version: 1.0 # Tested on: Kali linux, Windows 8.1 # PoC:
# Exploit Title: OOP CMS BLOG 1.0 - Cross-Site Request Forgery (Update Site Title and Description) # Exploit Author: Mr Winst0n # Author E-mail: manamtabeshekan[@]gmail[.]com # Discovery Date: March 1, 2019 # Vendor Homepage: http://zsoft.com.bd/ # Software Link : https://datapacket.dl.sourceforge.net/project/php-oop-cms-blog/blog_fo_rup.zip # Tested Version: 1.0 # Tested on: Kali linux, Windows 8.1 # PoC:
# Exploit Title: OOP CMS BLOG 1.0 - Cross-Site Request Forgery (Add Post) # Exploit Author: Mr Winst0n # Author E-mail: manamtabeshekan[@]gmail[.]com # Discovery Date: March 1, 2019 # Vendor Homepage: http://zsoft.com.bd/ # Software Link : https://datapacket.dl.sourceforge.net/project/php-oop-cms-blog/blog_fo_rup.zip # Tested Version: 1.0 # Tested on: Kali linux, Windows 8.1 # PoC:
# Note: Many other sections are vulnerable to CSRF, too. # For example: Delete Post, Add Slider, ...