首页    新闻    下载    文档    论坛     最新漏洞    黑客教程    数据库    搜索    小榕软件实验室怀旧版    星际争霸WEB版    最新IP准确查询   
名称: 密码:      忘记密码  马上注册
0day :: oday

PostCard 1.0 Remote Insecure Cookie Handling Vulnerability


http://www.gipsky.com/
--== ================================================================================ ==--
--== PostCard 1.0 Insecure Cookie Handling (Arbitrary Authentication) ==--
--== ================================================================================ ==--



Discovered By: t0pP8uZz
Discovered On: 13 April 2008
Script Download: N/A
DORK: N/A

Vendor Has Not Been Notified!


DESCRIPTION:
PostCard 1.0 (and prior???) suffers from insecure cookie handling.
to be able to view admin panel the user requires to login using a valid user/pass
after the valid user/pass has been passed and matches then a cookie is created
the admin panel checks to see if this cookie exists if it does then user can access admin.

since the cookie doesnt contain no hash/pass/sid just a number "1" indicating we are logged in, the remote
attacker can craft a cookie (working example below) to access admin



Vulnerability:
javascript:document.cookie = "logged_in=1; path=/;";


NOTE/TIP:
after running the above javascript (or adding cookies manually) you will be able to visit the admin panel at
"/postcard-admin.php"


GREETZ: milw0rm.com, h4ck-y0u.org, CipherCrew !


--== ================================================================================ ==--
--== PostCard 1.0 Insecure Cookie Handling (Arbitrary Authentication) ==--
--== ================================================================================ ==--

[2008-04-13]
<< XM Easy Personal FTP Server 5.4.0 (XCWD) Denial of Service Exploit Mumbo Jumbo Media OP4 Remote Blind SQL Injection Exploit >>
API:
gipsky.com & 安信网络

系统导航

 

Copyright © 2001-2010 安信网络. All Rights Reserved
京ICP备05056747号