PHP-Ring管理员Cookie绕过认证漏洞

BUGTRAQ ID: 30624 PHP-Ring是一个web ring系统，站点可通过webring系统增加访问量和指向站点的链接。 PHP-Ring没有安全地处理cookie。管理登录成功后，脚本会创建一个cookie显示用户所登录管理区域的剩余部分，但这个cookie不包含任何口令，因此用户可以伪造类似于合法登录的管理员cookie获得非授权访问。 以下是/admin/wradmin.php中的有漏洞代码： $cookie = $COOKIEadmin; //check for cookie if $cookie == "" OR $GETstop == 1 OR...

Authentication flaw

admin/wradmin.php in PHP-Ring Webring System aka uPHPringwebsite 0.9.1 allows remote attackers to bypass authentication and gain administrative access by setting the admin cookie to 1...

CVE-2008-3602

admin/wradmin.php in PHP-Ring Webring System aka uPHPringwebsite 0.9.1 allows remote attackers to bypass authentication and gain administrative access by setting the admin cookie to 1...

CVE-2008-3602

The CVE-2008-3602 entry concerns PHP-Ring Webring System (aka uPHP_ring_website) version 0.9.1. A flaw in admin/wr_admin.php allows remote attackers to bypass authentication and obtain administrative access by setting the admin cookie to 1. This is a cookie-based authentication bypass that enable...

CVE-2008-3602

admin/wradmin.php in PHP-Ring Webring System aka uPHPringwebsite 0.9.1 allows remote attackers to bypass authentication and gain administrative access by setting the admin cookie to 1...

PHP-Ring Webring System 0.9.1 Insecure Cookie Handling Vulnerability

No description provided by source. ...:::::PHP-Ring Webring System v0.9.1 Insecure Cookie Handling Vulnerability ::::.... Virangar Security Team www.virangar.net www.virangar.ir -------- Discoverd By :virangar security teamhadihadi special tnx to:MR.nosrati,black.shadowes,MR.hesy,Zahra & all...

PHP-Ring Webring System 0.9.1 Insecure Cookie Handling Vulnerability

Exploit for unknown platform in category web applications ==================================================================== PHP-Ring Webring System 0.9.1 Insecure Cookie Handling Vulnerability ==================================================================== ------- DESCRIPTION: PHP-Ring...

PHP-Ring Webring System 0.9.1 - Insecure Cookie Handling

PHP-Ring Webring System 0.9.1 - Insecure Cookie Handling ...:::::PHP-Ring Webring System v0.9.1 Insecure Cookie Handling Vulnerability ::::.... Virangar Security Team www.virangar.net www.virangar.ir -------- Discoverd By :virangar security teamhadihadi special tnx...

PHP-Ring Webring System 0.9.1 - Insecure Cookie Handling

...:::::PHP-Ring Webring System v0.9.1 Insecure Cookie Handling Vulnerability ::::.... Virangar Security Team www.virangar.net www.virangar.ir -------- Discoverd By :virangar security teamhadihadi special tnx to:MR.nosrati,black.shadowes,MR.hesy,Zahra & all virangar members & all hackerz greetz:t...

CVE-2007-6103

I Hear U IHU 0.5.6 and earlier allows remote attackers to cause 1 a denial of service infinite loop via a packet that contains zero in the size field in its header, which is improperly handled by the Receiver::processPacket function; and 2 a denial of service daemon crash via an a IHUINFOINIT or ...

CVE-2007-6103

I Hear U IHU 0.5.6 and earlier allows remote attackers to cause 1 a denial of service infinite loop via a packet that contains zero in the size field in its header, which is improperly handled by the Receiver::processPacket function; and 2 a denial of service daemon crash via an a IHUINFOINIT or ...

Design/Logic Flaw

I Hear U IHU 0.5.6 and earlier allows remote attackers to cause 1 a denial of service infinite loop via a packet that contains zero in the size field in its header, which is improperly handled by the Receiver::processPacket function; and 2 a denial of service daemon crash via an a IHUINFOINIT or ...

CVE-2007-6103

I Hear U IHU 0.5.6 and earlier allows remote attackers to cause 1 a denial of service infinite loop via a packet that contains zero in the size field in its header, which is improperly handled by the Receiver::processPacket function; and 2 a denial of service daemon crash via an a IHUINFOINIT or ...

Design/Logic Flaw

ageet AGEphone before 1.6.2, running on Windows Mobile 5 on the HTC HyTN Pocket PC device, allows remote attackers to 1 cause a denial of service call disruption and device hang via a SIP message with a malformed header and 2 cause a denial of service call disruption, false ring indication, and...

DSA-1304 kernel-source-2.6.8 - several

Bulletin has no description...

CVE-2007-2183

SQL injection vulnerability in index.php in PHP-Ring Webring System aka uPHPringwebsite 0.9 allows remote attackers to execute arbitrary SQL commands via the ring parameter...

Sql injection

SQL injection vulnerability in index.php in PHP-Ring Webring System aka uPHPringwebsite 0.9 allows remote attackers to execute arbitrary SQL commands via the ring parameter...

CVE-2007-2183

SQL injection vulnerability in index.php in PHP-Ring Webring System aka uPHPringwebsite 0.9 allows remote attackers to execute arbitrary SQL commands via the ring parameter...

CVE-2007-2183

The CVE-2007-2183 issue affects the PHP-Ring Webring System (also known as uPHP_ring_website) 0.9. The vulnerability is in index.php where the ring parameter enables SQL injection, allowing remote attackers to execute arbitrary SQL commands. This is a data-access issue with potential partial impa...

PHP-Ring Webring System 0.9 Remote SQL Injection Vulnerability

No description provided by source. Y! Underground Group http://2600.ir -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=- Portal.......: uPHPringwebsite Download.....: http://www.undoweb.frih.net ,...