# Name: Elite CMS 1.01 Multiple XSS/CSRF Vulnerabilities # Author: 10n1z3d <10n1z3d[at]w[dot]cn> # Date: Sat 10 Jul 2010 08:05:44 PM EEST # Vendor: http://elitecms.net/ # Download: http://elitecms.net/download.php?download=eliteCMS -=[ CSRF PoC 1 - Change Admin Password ]=- Elite CMS 1.01 Multiple XSS/CSRF Vulnerabilities - Change Admin Password
-=[ CSRF PoC 2 - Create Admin User ]=- Elite CMS 1.01 Multiple XSS/CSRF Vulnerabilities - Create Admin User
-=[ CSRF PoC 3 - Delete User ]=- Do you see this? -=[ CSRF PoC 4 - Delete Page ]=- Do you see this? -=[ CSRF PoC 5 - Delete Post ]=- Do you see this? -=[ CSRF PoC 6 - Logout The Administrator ]=- Do you see this? -=[ XSS ]=- http://[domain]/admin/edit_page.php?page=1[XSS] http://[domain]/admin/edit_post.php?page=1[XSS] http://[domain]/admin/add_post.php?page=1[XSS] Also all of the text fields in the administration panel accept xss code. Not so l33t huh? Visit us at http://www.evilzone.org/.