# Exploit Title: Ushahidi 2.2 Multiple Vulnerabilites # Date: 04/12/2012 # Author: shpendk # Software Link: http://download.ushahidi.com/ # Version: 2.2 # Tested on: Xampp on Windows # Vendor Contact: 03/25/2012 -> Contacted again: 03/28/2012 -> No Response yet: 04/11/2012 -> Full Disclosure: 04/12/2012 1) CSRF Add Admin PoC: ----------------------------------------------------------------------------------------------------- ------------------------------------------------------------------------------------------------------- 2) Persistent XSS ------------------------------------------------------------------------------------------------------ -> Go to http://127.0.0.1/login -> Create New User -> Enter username:

-> Login as Admin and go to http://127.0.0.1/admin/users ------------------------------------------------------------------------------------------------------