Vulners
Lucene search
Pointter PHP Content Management System Unauthorized Privilege Escalation
| Reporter | Title | Published | Views | Family All 11 |
|---|---|---|---|---|
 | Pointter PHP Content Management System Unauthorized Privilege | 16 Dec 201000:00 | – | zdt |
 | CVE-2010-4332 | 22 Dec 201001:00 | – | cve |
 | CVE-2010-4332 | 22 Dec 201001:00 | – | cvelist |
 | Pointter PHP Content Management System - Unauthorized Privilege Escalation | 15 Dec 201000:00 | – | exploitdb |
 | EUVD-2010-4304 | 7 Oct 202500:30 | – | euvd |
 | Pointter PHP Content Management System - Unauthorized Privilege Escalation | 15 Dec 201000:00 | – | exploitpack |
 | CVE-2010-4332 | 22 Dec 201003:00 | – | nvd |
 | Pointter PHP Content Management System 1.0 Privilege Escalation | 15 Dec 201000:00 | – | packetstorm |
 | Authentication flaw | 22 Dec 201003:00 | – | prion |
 | 'Pointter PHP Micro-Blogging Social 'Pointter PHP Content Management System' Unauthorized Privilege Escalation (CVE-2010-4332) | 17 Dec 201000:00 | – | securityvulns |
10
'Pointter PHP Content Management System' Unauthorized Privilege Escalation (CVE-2010-4332)
Mark Stanislav - [email protected]
I. DESCRIPTION
---------------------------------------
A vulnerability exists in the 'Pointter PHP Content Management System' authentication system which allows for administrative privileges by crafting two specific cookies with arbitrary values.
II. TESTED VERSION
---------------------------------------
1.0
III. PoC EXPLOIT
---------------------------------------
Using whatever method you prefer, generate 'auser' and 'apass' cookies. The values of each cookie are irrelevant; the mere presence of the cookies provide the administrative privilege.
IV. NOTES
---------------------------------------
* Here's a snippet of the final reply that I received from the vendor:
"Of course, it could be made safer and we know how to do it. But we have designed the softwares so that renaming admin folder gives us less work. As you know, the users should know the security issues as they will run this and not us."
V. SOLUTION
---------------------------------------
* There is no update released at this time. Avoidance of this software is recommended until an updated version is available.
VI. REFERENCES
---------------------------------------
http://www.pointter.com/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4332
http://www.uncompiled.com/2010/12/pointter-php-content-management-system-unauthorized-privilege-escalation-cve-2010-4332/
VII. TIMELINE
---------------------------------------
11/23/2010 - Initial vendor disclosure e-mail sent
11/24/2010 - Reply from vendor informing me that my 'software manipulation' was illegal
11/24/2010 - Response to vendor regarding their accusation of illegal actions on my part
11/24/2010 - Reply from vendor stating that by releasing this information, I am committing a crime
11/24/2010 - Response to vendor that their software is CC-licensed and that their accusations are unfounded
11/24/2010 - Rebuttal from vendor again affirming I was breaking the law by disclosing this vulnerability
11/24/2010 - Reply to vendor again stating my intent to help the company and provide responsible disclosure
11/24/2010 - Response from vendor stating they would no longer respond and explained their stance on fixing this issue
11/24/2010 - Final reply to vendor stating that I was happy to work with them on a delayed disclosure if desired
12/15/2010 - Public disclosure
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
01 Jul 2014 00:00Current
0.7Low risk
Vulners AI Score0.7
EPSS0.01708