CSRF

interface

Insert picture description here

Source code

<?php

if( isset( $_GET[ 'Change' ] ) ) {
    
    
    // Get input
    $pass_new  = $_GET[ 'password_new' ];
    $pass_conf = $_GET[ 'password_conf' ];

    // Do the passwords match?
    if( $pass_new == $pass_conf ) {
    
    
        // They do!
        $pass_new = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $pass_new ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
        $pass_new = md5( $pass_new );

        // Update the database
        $insert = "UPDATE `users` SET password = '$pass_new' WHERE user = '" . dvwaCurrentUser() . "';";
        $result = mysqli_query($GLOBALS["___mysqli_ston"],  $insert ) or die( '<pre>' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '</pre>' );

        // Feedback for the user
        echo "<pre>Password Changed.</pre>";
    }
    else {
    
    
        // Issue with passwords matching
        echo "<pre>Passwords did not match.</pre>";
    }

    ((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res);
}

?>

Code analysis

By obtaining the new password in the change form and the repeated new password, compare whether the two are the same, if they are the same, modify the password, if they are inconsistent, prompt an input error

Infiltration step

       Step 1: Click the change button to use burp suite to capture liuliangbao. Observing the traffic packet, it is found that the
Insert picture description here
       second step is to use the get request : construct the get request parameters, write the password_new and the parameters following passwprd_conf into the new password, and perform password tampering. The

       third step: test the old password and find that the login fails. tamper
Insert picture description here

Application scenario

By constructing hyperlinks on other pages, enticing users to click to change the user’s password

DVWA——CSRF(low)