Multi-Page Comment System 1.1.0 Insecure Cookie Handling Vulnerability

🗓️ 17 May 2008 00:00:00Reported by RootType

Multi-Page Comment System 1.1.0 Insecure Cookie Handling Vulnerability. Script creates insecure admin cookie without password


                                                --==+================================================================================+==--
--==+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Multi-Page&nbsp;Comment&nbsp;System&nbsp;1.1.0&nbsp;Insecure&nbsp;Cookie&nbsp;Handling&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;+==--
--==+================================================================================+==--



Discovered&nbsp;By:&nbsp;t0pP8uZz
Discovered&nbsp;On:&nbsp;15&nbsp;MAY
Script&nbsp;Download:&nbsp;http://tpvgames.co.uk/web/mpcs/
DORK:&nbsp;&quot;(Multi-Page&nbsp;Comment&nbsp;System)&quot;



Vendor&nbsp;Has&nbsp;Not&nbsp;Been&nbsp;Notified!




DESCRIPTION:&nbsp;

Multi-Page&nbsp;Comment&nbsp;System,&nbsp;suffers&nbsp;from&nbsp;insecure&nbsp;cookie&nbsp;handling,&nbsp;when&nbsp;a&nbsp;admin&nbsp;login&nbsp;is&nbsp;successfull&nbsp;the&nbsp;script&nbsp;creates
a&nbsp;cookie&nbsp;to&nbsp;show&nbsp;the&nbsp;rest&nbsp;of&nbsp;the&nbsp;admin&nbsp;area&nbsp;the&nbsp;user&nbsp;is&nbsp;already&nbsp;logged&nbsp;in.&nbsp;the&nbsp;bad&nbsp;thing&nbsp;is&nbsp;the&nbsp;cookie&nbsp;doesnt
contain&nbsp;any&nbsp;password&nbsp;or&nbsp;anything&nbsp;alike,&nbsp;therefor&nbsp;we&nbsp;can&nbsp;craft&nbsp;a&nbsp;admin&nbsp;cookie&nbsp;and&nbsp;make&nbsp;it&nbsp;look&nbsp;like&nbsp;we&nbsp;are
logged&nbsp;in&nbsp;as&nbsp;a&nbsp;legit&nbsp;admin.

the&nbsp;below&nbsp;javascript&nbsp;code&nbsp;will&nbsp;create&nbsp;a&nbsp;cookie,&nbsp;after&nbsp;pasting&nbsp;the&nbsp;code&nbsp;into&nbsp;your&nbsp;browser&nbsp;and&nbsp;running
on&nbsp;the&nbsp;affected&nbsp;domain,&nbsp;you&nbsp;can&nbsp;simply&nbsp;visit&nbsp;&quot;/admin.php&quot;&nbsp;and&nbsp;your&nbsp;admin.



Exploit:

javascript:document.cookie&nbsp;=&nbsp;&quot;CommentSystemAdmin=1;&nbsp;path=/&quot;;



NOTE/TIP:&nbsp;

after&nbsp;pasting&nbsp;the&nbsp;above&nbsp;javascript&nbsp;code&nbsp;into&nbsp;your&nbsp;browser&nbsp;you&nbsp;can&nbsp;visit&nbsp;&quot;/admin.php&quot;&nbsp;to&nbsp;see&nbsp;your&nbsp;a&nbsp;admin.

(this&nbsp;just&nbsp;shows&nbsp;how&nbsp;many&nbsp;bad&nbsp;programmers&nbsp;are&nbsp;out&nbsp;there.)



GREETZ:&nbsp;milw0rm.com,&nbsp;h4ck-y0u.org,&nbsp;CipherCrew&nbsp;!



peace,&nbsp;t0pP8uZz



--==+================================================================================+==--
--==+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Multi-Page&nbsp;Comment&nbsp;System&nbsp;1.1.0&nbsp;Insecure&nbsp;Cookie&nbsp;Handling&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;+==--
--==+================================================================================+==--

17 May 2008 00:00Current

7.1High risk

Vulners AI Score7.1