CVE-2010-3024

DiamondList 0.1.6 - Cross-Site Request Forgery in User Update Function

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2010-3024. PoCs published by High-Tech Bridge SA.

AI-analyzed exploit summary This exploit demonstrates a CSRF vulnerability in DiamondList 0.1.6, allowing an attacker to submit a crafted form to update user details, including passwords, without proper request verification. The PoC includes a hidden form with JavaScript auto-submission to trigger the attack.

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in user/main/update_user in DiamondList 0.1.6, and possibly earlier, allow remote attackers to hijack the authentication of administrators for requests that (1) change the administrative password or (2) change the site's configuration.

Exploits (1)

exploitdb WORKING POC VERIFIED

by High-Tech Bridge SA · htmlwebappsphp

https://www.exploit-db.com/exploits/14565

View Code ZIP pw:eip

This exploit demonstrates a CSRF vulnerability in DiamondList 0.1.6, allowing an attacker to submit a crafted form to update user details, including passwords, without proper request verification. The PoC includes a hidden form with JavaScript auto-submission to trigger the attack.

Classification

Working Poc 100%

Attack Type

Other

Complexity

Trivial

Reliability

Reliable

Target: DiamondList 0.1.6 and prior versions

No auth needed

Prerequisites: Victim must be authenticated in the target application · Attacker must trick victim into visiting a malicious page

MITRE ATT&CK