PhShoutBox <= 1.5 (final) Insecure Cookie Handling Vulnerability

🗓️ 19 Apr 2008 00:00:00Reported by RootType

PhShoutBox version 1.5 Insecure Cookie Handling Vulnerability allows remote attacker to gain admin access by crafting a cookie


                                                --==+================================================================================+==--
--==+&nbsp;PhShoutBox&nbsp;&lt;=&nbsp;1.5&nbsp;(final)&nbsp;Insecure&nbsp;Cookie&nbsp;Handling&nbsp;(Arbitrary&nbsp;Authentication)&nbsp;&nbsp;+==--
--==+================================================================================+==--



Discovered&nbsp;By:&nbsp;t0pP8uZz
Discovered&nbsp;On:&nbsp;18&nbsp;April&nbsp;2008
Script&nbsp;Download:&nbsp;http://phphq.net/scripts.php?p=free-scripts&amp;id=2
DORK:&nbsp;inurl:&quot;phshoutbox.php&quot;

Vendor&nbsp;Has&nbsp;Not&nbsp;Been&nbsp;Notified!


DESCRIPTION:&nbsp;
PhShoutBox&nbsp;suffers&nbsp;from&nbsp;insecure&nbsp;cookie&nbsp;handling,&nbsp;allowing&nbsp;the&nbsp;remote&nbsp;attacker&nbsp;to&nbsp;craft&nbsp;a&nbsp;cookie&nbsp;that&nbsp;
makes&nbsp;the&nbsp;attacker&nbsp;look&nbsp;like&nbsp;a&nbsp;admin,&nbsp;this&nbsp;works&nbsp;because&nbsp;the&nbsp;admin&nbsp;panel&nbsp;only&nbsp;checks&nbsp;the&nbsp;password
if&nbsp;a&nbsp;password&nbsp;has&nbsp;been&nbsp;posted&nbsp;using&nbsp;the&nbsp;php&nbsp;vars&nbsp;&quot;$_POST&quot;&nbsp;if&nbsp;POST&nbsp;isnt&nbsp;set,&nbsp;then&nbsp;the&nbsp;cookies&nbsp;will&nbsp;be&nbsp;checked
for&nbsp;existance&nbsp;if&nbsp;they&nbsp;exist&nbsp;then&nbsp;it&nbsp;will&nbsp;grant&nbsp;admin.

the&nbsp;javascript&nbsp;code&nbsp;below&nbsp;is&nbsp;the&nbsp;easyiesy&nbsp;way&nbsp;to&nbsp;do&nbsp;this,&nbsp;just&nbsp;paste&nbsp;it&nbsp;in&nbsp;your&nbsp;browser&nbsp;whilst
at&nbsp;the&nbsp;vulnerable&nbsp;site,&nbsp;then&nbsp;visit&nbsp;&quot;admin.php&quot;


Vulnerability:
version&nbsp;1.5:&nbsp;&nbsp;&nbsp;javascript:document.cookie&nbsp;=&nbsp;&quot;phadmin=True;&nbsp;path=/;&quot;;
version&nbsp;&lt;&nbsp;1.4:&nbsp;javascript:document.cookie&nbsp;=&nbsp;&quot;ssbadmin=True;&nbsp;path=/;&quot;;


NOTE/TIP:&nbsp;
admin&nbsp;login&nbsp;is&nbsp;at&nbsp;&quot;/admin.php&quot;&nbsp;on&nbsp;1.5&nbsp;final
and&nbsp;at&nbsp;&quot;/shoutadmin.php&quot;&nbsp;on&nbsp;1.4&nbsp;&amp;&nbsp;below


GREETZ:&nbsp;milw0rm.com,&nbsp;h4ck-y0u.org,&nbsp;CipherCrew&nbsp;!



--==+================================================================================+==--
--==+&nbsp;PhShoutBox&nbsp;&lt;=&nbsp;1.5&nbsp;(final)&nbsp;Insecure&nbsp;Cookie&nbsp;Handling&nbsp;(Arbitrary&nbsp;Authentication)&nbsp;&nbsp;+==--
--==+================================================================================+==--

19 Apr 2008 00:00Current

7.1High risk

Vulners AI Score7.1

PhShoutBox &lt;= 1.5 (final) Insecure Cookie Handling Vulnerability

PhShoutBox <= 1.5 (final) Insecure Cookie Handling Vulnerability