{"type": "packetstorm", "published": "2010-03-31T00:00:00", "reporter": "indoushka", "hashmap": [{"key": "bulletinFamily", "hash": "708697c63f7eb369319c6523380bdf7a"}, {"key": "cvelist", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cvss", "hash": "d4be9c4fc84262b4f39f89565918568f"}, {"key": "description", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "href", "hash": "e9a110d8ada5bd4777a783dd4596faf0"}, {"key": "modified", "hash": "facaad3e6a1eb98ea6be36ef02fdd0e0"}, {"key": "objectVersion", "hash": "56765472680401499c79732468ba4340"}, {"key": "published", "hash": "facaad3e6a1eb98ea6be36ef02fdd0e0"}, {"key": "references", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "reporter", "hash": "841169f23cc6417d1cc9372dea976fab"}, {"key": "sourceData", "hash": "235b2aa19cb725926dcab7ffdaf9b599"}, {"key": "sourceHref", "hash": "dd7c53ca37eb506826decb17b8b8ba63"}, {"key": "title", "hash": "83d67653494327634a3dbe1432257421"}, {"key": "type", "hash": "6466ca3735f647eeaed965d9e71bd35d"}], "bulletinFamily": "exploit", "cvss": {"vector": "NONE", "score": 0.0}, "sourceData": "`======================================================================================== \n| # Title : Simple Machines Forum 1.1.11 Mullti Vulnerability \n| # Author : indoushka \n| # email : indoushka@hotmail.com \n| # Home : www.sec-war.com \n| # Web Site : http://www.simplemachines.org/ \n| # Dork : Powered by SMF 1.1.11 | SMF \u00a9 2006-2009, Simple Machines LLC \n| # Tested on: windows SP2 Fran\u00e7ais V.(Pnx2 2.0) + Lunix Fran\u00e7ais v.(9.4 Ubuntu) \n| # Bug : Mullti \n====================== Exploit By indoushka ================================= \n# Exploit : \n \n1- Mail List information : \n \nAfter Register go to : http://127.0.0.1/smf/index.php?action=mlist \n \n2- PHPSESSID session fixation: \nVulnerability description \nThis script is vulnerable to PHPSESSID session fixation attacks. \n \nBy injecting a custom PHPSESSID is possible to alter the PHP session cookie. Attackers will normally manipulate cookie values to fraudulently authenticate themselves on a web site. \nThis vulnerability affects /smf. \nThe impact of this vulnerability \nBy exploiting this vulnerability, an attacker may conduct a session fixation attack. In a session fixation attack, the attacker fixes the user's session ID before the user even logs into the target server, thereby eliminating the need to obtain the user's session ID afterwards. \n \nAttack details : \n \nGET /smf/?PHPSESSID=smfssionfixation \n \nHow to fix this vulnerability \nSet session.use_only_cookies = 1 from php.ini. This option enables administrators to make their users invulnerable to attacks which involve passing session ids in URLs; defaults to 0. \n \nWeb references : \n \nhttp://www.acros.si/papers/session_fixation.pdf \n \nhttp://www.php.net/session \n \nhttp://www.owasp.org/index.php/PHP_Top_5 \n \n \nDz-Ghost Team ===== Saoucha * Star08 * Redda * Silitoad * n2n ========================================== \nNot : Please I need financial assistance in order I make a tax to the \nstate treasury before the ruling, final and unconditional access \nmy release by mail and transportation Algerian approximately 500 U.S. dollars \nccp:0013791941 Salah Eddine Nekaa \n-------------------------------------------------------------------------------------------------------- \n`\n", "viewCount": 1, "history": [], "lastseen": "2016-11-03T10:21:03", "objectVersion": "1.2", "href": "https://packetstormsecurity.com/files/87808/Simple-Machines-Forum-1.1.11-Session-Fixation.html", "sourceHref": "https://packetstormsecurity.com/files/download/87808/smf1111-fixation.txt", "title": "Simple Machines Forum 1.1.11 Session Fixation", "enchantments": {"score": {"value": -0.1, "vector": "NONE", "modified": "2016-11-03T10:21:03"}, "dependencies": {"references": [], "modified": "2016-11-03T10:21:03"}, "vulnersScore": -0.1}, "references": [], "id": "PACKETSTORM:87808", "hash": "74b88fb35063c39b39241bb704291a8e2df8fb37a71de1367fa17c990c39a8ac", "edition": 1, "cvelist": [], "modified": "2010-03-31T00:00:00", "description": ""}