[MajorSecurity #26] Woltlab Burning Board - Multiple Cookie manipulation and session fixation vulnerabilities

MajorSecurity 26 Woltlab Burning Board - Multiple Cookie manipulation and session fixation vulnerabilities ---------------------------------------------------------------------------------------- Software: Woltlab Burning board Impact: Cookie manipulation and Session Fixation Made public: July,...

CVE-2006-3797

CVE-2006-3797 describes an SQL injection vulnerability in DeluxeBB 1.07 and earlier that lets remote attackers bypass authentication, spoof users, and modify settings via the (1) memberpw and (2) membercookie cookies. The issue enables manipulation of authentication-related flows and user setting...

DeluxeBB 1.07 - Remote Create Admin

DeluxeBB 1.07 - Remote Create Admin !/usr/bin/perl DeluxeBB new or die; $cookiejar = HTTP::Cookies-new; $xpl-cookiejar $cookiejar ; $res = $xpl-post$url.'misc.php', Content = "sub" = "login", "name" = "$uname", "password" = "$passwd", "submit" = "Log-in", "redirect" = "", "expiry" = "990090909", ...

Authentication flaw

FileProtection Express 1.0.1 and earlier allows remote attackers to bypass authentication via a cookie with an Admin value of 1...

Directory traversal

Directory traversal vulnerability in the session handling class GallerySession.class in Gallery 2 up to 2.0.2 allows remote attackers to access and delete files by specifying the session in a cookie, which is used in constructing file paths before the session value is sanitized...

MyBB104SQL.txt

!/usr/bin/perl -w MyBB : DONT FORGET TO DO YOUR CONFIG !! DONT FORGET TO DO YOUR CONFIG !! DONT FORGET TO DO YOUR CONFIG !! use IO::Socket; -- Start -- $host = "127.0.0.1"; $path = "/mybb3/"; $userid = 1; $mycookie = "mybbuser=1xommhw5h9kZZGSFUppacVfacykK1gnd84PLehjlhTGC1ZiQkXr;"; -- END -- $host...

vuBB <= 0.2 (Cookie) Final Remote SQL Injection Exploit (mq=off)

No description provided by source. !/usr/bin/perl print q ---------------------------------------------------------------------- vuBB =0.2 Final Remote SQL Injection cookies Exploit exploit discovered and coded by KingOfSKa https://contropotere.netsons.org...

MyBulletinBoard (MyBB) 1.03 - misc.php SQL Injection

MyBulletinBoard MyBB 1.03 - misc.php SQL Injection MyBB New SQL Injection D3vil-0x1 Milw0rm ID :- http://www.milw0rm.com/auth.php?id=1320 The Inf.File :- misc.php Linez :- code $buddies = $mybb-user'buddylist'; $namesarray = explode",",$buddies; ifisarray$namesarray whilelist$key, $buddyid =...

CVE-2005-2464

login.php in PCXP/TOPPE CMS allows remote attackers to bypass authentication and gain privileges by modifying the cookie to match the target userid...

gmailbug.txt

Gmail Bug - INTRODUCTION This bug has already been corrected, that's why it's been published. In this manual you will see step by step how to exploit Gmail's vulnerability, that gave you access to any account, reported by Anelkaos, colaborator of elhacker.net's forum and patched by Google by...

CVE-2002-2163

KvPoll 1.1 allows remote authenticated users to vote more than once by setting the "alreadyvoted" cookie by various methods, including a direct call to clearcookies.php...

ASP-Nuke伪造Cookie导致信息泄露漏洞

BugCVE: CVE-2002-0523 BUGTRAQ: 4489 ASP-Nuke存在设计问题，可导致攻击者获得主机相关敏感信息。 攻击者可以本地修改Cookie信息并提交，导致主机返回所有当前登陆用户列表或者返回包含WEB ROOT路径的错误信息。 攻击者可以利用这些信息进一步对系统进行攻击。 ASP-Nuke RC1-RC2 厂商补丁： ASP-Nuke -------- 目前厂商已经在最新版本的软件中修补了此漏洞，请到厂商的主页获取最新版本： http://www.asp-nuke.com/downloads.asp...

CVE-2005-3005

Helpdesk Software Hesk allows remote attackers to bypass authentication for 1 admin.php and 2 adminmain.php by modifying the PHPSESSID session ID parameter or cookie...

invision203Login.pl.txt

!/usr/bin/perl -w This one actually works : Just paste the outputted cookie into your request header using livehttpheaders or something and you will probably be logged in as that user. No need to decrypt it! Exploit coded by "Tony Little Lately" and "Petey Beege" use LWP::UserAgent; $ua = new...

CVE-2005-1558

The web module in Neteyes Nexusway allows remote attackers to bypass authentication and gain administrator privileges by setting the cyclone500auth cookie...

CVE-2005-1482

ArticleLive 2005 allows remote attackers to gain privileges by modifying the 1 auth and 2 userId fields in a cookie...

CVE-2004-1847

News Manager Lite 2.5 allows remote attackers to bypass authentication and gain administrator privileges by setting the ADMIN parameter in the NEWSLOGIN cookie...

r57punbb.pl.txt

!/usr/bin/perl use IO::Socket; PunBB version 1 // Check if there's a user with the user ID and password hash from the cookie $result = $db-query'SELECT .... tra-la-la... ; $punuser = $db-fetchassoc$result; // If user authorisation failed if !isset$punuser'id' || md5$cookieseed.$punuser'password' ...

PunBB 1.2.2 - Authentication Bypass

PunBB 1.2.2 - Authentication Bypass !/usr/bin/perl use IO::Socket; PunBB version 1 // Check if there's a user with the user ID and password hash from the cookie $result = $db-query'SELECT .... tra-la-la... ; $punuser = $db-fetchassoc$result; // If user authorisation failed if !isset$punuser'id' |...

PunBB version <= 1.2.2 Authentication Bypass Exploit

No description provided by source. !/usr/bin/perl use IO::Socket; PunBB version = 1.2.2 auth bypass exploit ------------------------------------------------- About vuln: lets look file /include/functions.php code start function checkcookie&$punuser ... if isset$COOKIE$cookiename...