s-cms has a  CSRF in member/member_edit.php

政府建站系统存在csrf in member/member_edit.php
1.注册一个账户Sea0o
![a](https://user-images.githubusercontent.com/48739932/66995086-fe48f900-f100-11e9-9807-f75063ffa675.png)

2.注册另一个账户CSRF1
![b](https://user-images.githubusercontent.com/48739932/66995134-11f45f80-f101-11e9-8206-72e82538242c.png)

3.在用户Sea0o个人信息界面填入如下信息，利用burp抓包
![c](https://user-images.githubusercontent.com/48739932/66995187-26d0f300-f101-11e9-849b-4b84334355e6.png)

![e](https://user-images.githubusercontent.com/48739932/66995191-29334d00-f101-11e9-81a1-7dafeb1caf0d.png)

构造csrf poc
![f](https://user-images.githubusercontent.com/48739932/66995216-30f2f180-f101-11e9-885b-232fedbc27cf.png)

4.发送给用户CSRF1
![1](https://user-images.githubusercontent.com/48739932/66995240-410ad100-f101-11e9-8288-2b871ed5b991.png)

5.用户点击，成功修改CSRF1信息

![3](https://user-images.githubusercontent.com/48739932/66995253-47994880-f101-11e9-9995-b6c76bb08b2a.png)

![csrf](https://user-images.githubusercontent.com/48739932/66995305-5d0e7280-f101-11e9-9b7b-c9009e6944e1.png)



Provide feedback

Saved searches

Use saved searches to filter your results more quickly

s-cms has a CSRF in member/member_edit.php #3

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

s-cms has a CSRF in member/member_edit.php #3

Description

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions