=============================================================================================================================================
| # Title : Loan Management System 1.0 CSRF Vulnerability |
| # Author : indoushka |
| # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 128.0.3 (64 bits) |
| # Vendor : https://www.sourcecodester.com/sites/default/files/download/oretnom23/loan-management-system.zip |
=============================================================================================================================================
poc :
[+] Dorking İn Google Or Other Search Enggine.
[+] This HTML page :
is a user registration form that allows users to input a username, password, and upload an avatar image.
The form data is then sent via an AJAX request to a server-side script for processing.
[+] Here's a breakdown of how it works:
HTML Structure
Form Elements:
username: A text field where the user can input their username.
password: A password field for entering a password.
img: A file input for uploading an avatar image (restricted to image file types).
Save User Button:
An input element with the type button is used to trigger the saveUser() function when clicked.
[+] JavaScript (AJAX Request)
AJAX Request:
An XMLHttpRequest object (xhr) is used to send the form data to a server-side script (Users.php).
The request method is POST, and the data is sent to the specified URL.
The onload function checks if the request was successful (status code 200). If it was,
it alerts the user that the save was successful; otherwise, it alerts the user of an error.
[+] save code as poc.html
[+] payload :
User Registration
User Registration
Greetings to :============================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * CraCkEr |
==========================================================================